By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 27 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
33Monitor	CVE-2026-74033No exploit	Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlerswazuh · wazuh-manager · CWE-22 Path traversal	High8.4	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-74034Proof of concept	Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Commandwazuh · wazuh-manager · CWE-862 Pre-auth Broken access control (IDOR)	High8.7	—	0.4%	Oct 13, 2026
34Monitor	CVE-2026-74035No exploit	Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_userwazuh · wazuh-manager · CWE-863 Auth bypass Broken access control (IDOR)	High8.6	—	0.6%	Oct 13, 2026
34Monitor	CVE-2026-74036No exploit	Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policieswazuh · wazuh-agent · CWE-863 RCE Broken access control (IDOR)	High8.6	—	0.8%	Oct 13, 2026
34Monitor	CVE-2026-74037No exploit	Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_tokenwazuh · wazuh-manager · CWE-613	High8.6	—	0.4%	Oct 13, 2026
37Monitor	CVE-2026-74040No exploit	Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_workerwazuh · wazuh-manager · CWE-862 RCE Broken access control (IDOR)	Critical9.4	—	0.7%	Oct 13, 2026
34Monitor	CVE-2026-74041No exploit	Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatchwazuh · wazuh-manager · CWE-178	High8.6	—	0.4%	Oct 13, 2026
34Monitor	CVE-2026-74043No exploit	Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functionswazuh · wazuh-manager · CWE-22 Path traversal	High8.5	—	0.4%	Oct 13, 2026
28Monitor	CVE-2026-74045No exploit	Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoderwazuh · wazuh-manager · CWE-122 Memory safety	High7.1	—	0.3%	Oct 13, 2026
28Monitor	CVE-2026-74047No exploit	Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpointwazuh · wazuh-manager · CWE-200 Info leak	High7.1	—	0.3%	Oct 13, 2026
32Monitor	CVE-2026-93907No exploit	IBM WebSphere Application Server is affected by a bypass authentication vulnerabilityibm · websphere application server · CWE-287 Pre-auth Auth bypass	High8.1	—	0.3%	Oct 13, 2026
32Monitor	CVE-2026-95680No exploit	IBM WebSphere Application Server is affected by an authorization bypassibm · websphere application server · CWE-287 Auth bypass	High8.0	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-102250No exploit	CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authoschneider electric · sage rtu 1410 · CWE-345	High8.6	—	0.1%	Oct 13, 2026
38Monitor	CVE-2026-104192No exploit	DragonflyDB stream RDB deserialization double-freedragonflydb · dragonfly · CWE-415 Pre-auth Deserialization Memory safety	Critical9.6	—	0.2%	Oct 13, 2026
36Monitor	CVE-2026-107460No exploit	Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebindingapache software foundation · apache fesod (incubating) · CWE-918 Pre-auth SSRF	Critical9.1	—	0.4%	Oct 13, 2026
29Monitor	CVE-2026-108184No exploit	Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure vzoom communications · zoom clients · CWE-295 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 13, 2026
29Monitor	CVE-2026-108185No exploit	Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information zoom communications · zoom clients · CWE-295 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 13, 2026
35Monitor	CVE-2026-12655No exploit	1732E ArmorBlock® - Multiple Vulnerabilitiesrockwell automation · 1732e armorblock® i/o · CWE-294 Pre-auth Auth bypass	High8.8	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-12656No exploit	1732E ArmorBlock® - Multiple Vulnerabilitiesrockwell automation · 1732e armorblock® i/o · CWE-770 Pre-auth Denial of service	High8.7	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-18228No exploit	Hyperscale Path Traversalcommvault · commvault cloud · CWE-22 Path traversal	High7.1	—	0.3%	Oct 13, 2026
32Monitor	CVE-2026-53418No exploit	Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated userzoom communications · zoom workplace · CWE-939	High8.1	—	0.3%	Oct 13, 2026
32Monitor	CVE-2026-53420No exploit	Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege viazoom communications · zoom workplace · CWE-120 Memory safety	High8.0	—	0.3%	Oct 13, 2026
39Monitor	CVE-2026-53709No exploit	MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryibm · mcp-context-forge · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.6%	Oct 13, 2026
34Monitor	CVE-2026-65198No exploit	Huawei Default SNMPv3 USM keyhuawei · openubmc · CWE-321 Pre-auth Hard-coded credentials	High8.6	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-77090No exploit	CVFS Information Disclosurecommvault · commvault cloud · CWE-611 Pre-auth XXE	High8.7	—	0.3%	Oct 13, 2026
28Monitor	CVE-2026-77093No exploit	CvFWD Denial of Servicecommvault · commvault cloud · CWE-190 Memory safety	High7.1	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-77094No exploit	CvFWD Out-of-Bounds Writecommvault · commvault cloud · CWE-787 Memory safety	High7.1	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-77095No exploit	CvFWD Null Pointer Dereferencecommvault · commvault cloud · CWE-476 Memory safety	High7.1	—	0.2%	Oct 13, 2026
30Monitor	CVE-2026-77096No exploit	CVFS Missing Authenticationcommvault · commvault cloud · CWE-306 pre-auth RCE Auth bypass	High7.7	—	0.2%	Oct 13, 2026
37Monitor	CVE-2026-77099No exploit	CVFS Command Executioncommvault · commvault cloud · CWE-78 pre-auth RCE Command injection	Critical9.3	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-77100No exploit	MediaAgent Denial of Servicecommvault · commvault cloud · CWE-122 Pre-auth Memory safety	High8.7	—	0.3%	Oct 13, 2026
30Monitor	CVE-2026-95114No exploit	libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c.CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 13, 2026
30Monitor	CVE-2026-95115No exploit	Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parserCWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 13, 2026
31Monitor	CVE-2026-95121No exploit	An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp.CWE-190 RCE Memory safety	High7.8	—	0.2%	Oct 13, 2026
30Monitor	CVE-2026-95122No exploit	mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp.CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 13, 2026
30Monitor	CVE-2026-95124No exploit	Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size CWE-120 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 13, 2026
30Monitor	CVE-2026-95127No exploit	An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.cCWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 13, 2026
28Monitor	CVE-2026-97333No exploit	QAPI stack-based buffer overflowcommvault · commvault cloud · CWE-121 Memory safety	High7.1	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-97334No exploit	Network messaging layer decompression resource exhaustioncommvault · commvault cloud · CWE-409 Pre-auth	High8.7	—	0.3%	Oct 13, 2026
39Monitor	CVE-2024-34320No exploit	ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Oct 13, 2026
40Plan	CVE-2024-34323No exploit	ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.CWE-639 Pre-auth Broken access control (IDOR)	Critical10.0	—	0.3%	Oct 13, 2026
36Monitor	CVE-2024-34324No exploit	An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character CWE-384 Pre-auth	Critical9.1	—	0.2%	Oct 13, 2026
30Monitor	CVE-2026-102699No exploit	Arm: multiple issues with GNTTABOP_cache_flushxen · xen · CWE-191 Pre-auth Memory safety Denial of service	High7.5	—	0.2%	Oct 13, 2026
30Monitor	CVE-2026-102702No exploit	Arm: multiple issues with GNTTABOP_cache_flushxen · xen · CWE-191 Pre-auth Memory safety Denial of service	High7.5	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-102982No exploit	Plane: XSS in work item commentsmakeplane · plane · CWE-79 XSS	High8.5	—	0.3%	Oct 13, 2026
37Monitor	CVE-2026-103928No exploit	Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functionsmetabase · metabase · CWE-73 Pre-auth Path traversal	Critical9.3	—	0.4%	Oct 13, 2026
28Monitor	CVE-2026-104004No exploit	Collection validators using collation-accepting expressions can crash MongoDB Server on insertmongodb · mongodb server · CWE-476 Memory safety	High7.1	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-104005No exploit	Incorrect authorization in MongoDB Server router for bulk writes to system namespacesmongodb · mongodb server · CWE-617	High7.1	—	0.2%	Oct 13, 2026
91Now	CVE-2026-104935Weaponized	Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.ivanti · connect secure · CWE-290 pre-auth RCE Auth bypass	High8.6	KEV	88.9%	Oct 13, 2026
27Monitor	CVE-2026-110025Proof of concept	slackero phpwcms Extension Check cnt23.article.inc.php unrestricted uploadslackero · phpwcms · CWE-284 Pre-auth File upload Broken access control (IDOR)	Medium6.9	—	0.3%	Oct 13, 2026
35Monitor	CVE-2026-55376No exploit	heym Python Tool Sandbox Escapeheymrun · heym · CWE-78 RCE Command injection	High8.8	—	0.4%	Oct 13, 2026
40Plan	CVE-2026-55675No exploit	Salty documentation workflow executes fork-controlled Python build hooks with deployment secretssaltyorg · docs · CWE-94 pre-auth RCE	Critical10.0	—	0.4%	Oct 13, 2026
36Monitor	CVE-2026-55695No exploit	FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updaterfearlessgeekmedia · fearlesscms · CWE-94 RCE	Critical9.1	—	0.4%	Oct 13, 2026
39Monitor	CVE-2026-78802No exploit	An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrarCWE-94 pre-auth RCE	Critical9.8	—	0.5%	Oct 13, 2026
39Monitor	CVE-2026-79608No exploit	x86/AMD: ineffectual Zenbleed workaroundxen · xen · CWE-670 Pre-auth	Critical9.8	—	0.3%	Oct 13, 2026
35Monitor	CVE-2026-79609No exploit	x86: XPTI may break on huge-memory systemsxen · xen · CWE-284 Broken access control (IDOR)	High8.8	—	0.1%	Oct 13, 2026
35Monitor	CVE-2026-79610No exploit	grant-table: double version change racexen · xen · CWE-362 Race condition	High8.8	—	0.1%	Oct 13, 2026
28Monitor	CVE-2026-96299No exploit	Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Servicemongodb · mongodb server · CWE-617	High7.1	—	0.2%	Oct 13, 2026
37Monitor	CVE-2026-102989No exploit	TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsestanstack · router · CWE-79 Pre-auth XSS	Critical9.3	—	0.5%	Oct 13, 2026
30Monitor	CVE-2026-103030No exploit	Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`cfug · dio · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Oct 13, 2026
39Monitor	CVE-2026-106042No exploit	An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to rivanti · xtraction · CWE-73 Path traversal	Critical9.9	—	0.7%	Oct 13, 2026
30Monitor	CVE-2026-106043No exploit	A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacivanti · xtraction · CWE-306 Pre-auth Auth bypass	High7.5	—	0.6%	Oct 13, 2026
30Monitor	CVE-2026-106047No exploit	A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated ivanti · xtraction · CWE-22 Path traversal	High7.7	—	0.7%	Oct 13, 2026
39Monitor	CVE-2026-109412No exploit	An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication infivanti · neurons patch for intune · CWE-749	Critical9.9	—	0.8%	Oct 13, 2026
34Monitor	CVE-2026-110097No exploit	Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Tokenikaros-dev · ikaros · CWE-287 Auth bypass	High8.6	—	0.5%	Oct 13, 2026
30Monitor	CVE-2026-110102No exploit	powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installerromkatv · powerlevel10k · CWE-494 Pre-auth	High7.7	—	0.1%	Oct 13, 2026
32Monitor	CVE-2026-110104No exploit	novel through 3.5.0 Unsalted MD5 Password Storagexxyopen · novel · CWE-916 Pre-auth	High8.2	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-110108No exploit	MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage APImateaix · matecloud · CWE-862 Broken access control (IDOR)	High8.6	—	0.3%	Oct 13, 2026
28Monitor	CVE-2026-110109No exploit	JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Savejetlinks · jetlinks community · CWE-862 RCE Broken access control (IDOR)	High7.1	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-110115No exploit	Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStreamrisesoft-y9 · digital-infrastructure · CWE-22 Pre-auth Path traversal	High8.7	—	0.4%	Oct 13, 2026
35Monitor	CVE-2026-110116No exploit	Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFilerisesoft-y9 · digital-infrastructure · CWE-22 Pre-auth Path traversal	High8.8	—	0.5%	Oct 13, 2026
28Monitor	CVE-2026-110117No exploit	SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController1024-lab · smartadmin · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-110118No exploit	WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpointsrisesoft-y9 · workflow-engine · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-110119No exploit	yshopmall through 2.0.0 IDOR via Member Address API in UserAddressControllerguchengwuyue · yshopmall · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Oct 13, 2026
28Monitor	CVE-2026-110121No exploit	PickMall lilishop through 4.4 IDOR via Goods Edit Endpointpickmall · lilishop · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-110123No exploit	Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpointsmakunet · maku-boot · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-110124No exploit	FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpointskerwincui · fastbee · CWE-639 Broken access control (IDOR)	High8.6	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-110128No exploit	fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detailfushengqian · fuint · CWE-306 Pre-auth Auth bypass	High8.7	—	0.4%	Oct 13, 2026
28Monitor	CVE-2026-110129No exploit	fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detailfushengqian · fuintcatering · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-53562No exploit	Local Privilege Escalationcitrix · uniconos · CWE-59 Local privilege escalation	High8.5	—	0.2%	Oct 13, 2026
36Monitor	CVE-2026-54454No exploit	OpenCATS: Authenticated RCE in the Import moduleopencats · opencats · CWE-434 RCE File upload	Critical9.1	—	0.4%	Oct 13, 2026
30Monitor	CVE-2026-54640No exploit	OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactoryopenremote · openremote · CWE-611 XXE	High7.6	—	0.2%	Oct 13, 2026
30Monitor	CVE-2026-54641No exploit	OpenRemote: Cross-Realm User Information Disclosure in UserResourceImplopenremote · openremote · CWE-639 Broken access control (IDOR)	High7.7	—	0.2%	Oct 13, 2026
38Monitor	CVE-2026-55183No exploit	RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Pagezarestia-dev · rclone-manager · CWE-306 Pre-auth Auth bypass	Critical9.6	—	0.4%	Oct 13, 2026
36Monitor	CVE-2026-55562No exploit	Cronicle: Stored XSS in admin Activity Log via account full_name fieldjhuckaby · cronicle · CWE-79 XSS	Critical9.0	—	0.4%	Oct 13, 2026
34Monitor	CVE-2026-55823No exploit	Frappe: Possibility of SQL injection in reportviewfrappe · frappe · CWE-89 SQL injection	High8.7	—	0.3%	Oct 13, 2026
31Monitor	CVE-2026-61642No exploit	Squid Request Smuggling in HTTP Transfer-Encodingsquid-cache · squid · CWE-444	High7.7	—	2.0%	Oct 13, 2026
39Monitor	CVE-2026-69227No exploit	BUG-000187331 Portal for ArcGIS has a security vulnerabilityesri · portal for arcgis · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 13, 2026
39Monitor	CVE-2026-77459No exploit	Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksargoproj · argo-cd · CWE-863 Broken access control (IDOR)	Critical9.9	—	0.4%	Oct 13, 2026
39Monitor	CVE-2026-78799No exploit	Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router ECWE-22 pre-auth RCE Path traversal	Critical9.8	—	1.3%	Oct 13, 2026
30Monitor	CVE-2026-82416No exploit	FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared modulephp · frankenphp · CWE-362 Pre-auth Race condition	High7.7	—	0.2%	Oct 13, 2026
35Monitor	CVE-2026-85990No exploit	Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methodsleantime · leantime · CWE-269	High8.8	—	0.4%	Oct 13, 2026
40Plan	CVE-2026-94603No exploit	Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationpodman-container-tools · podman · CWE-693 Pre-auth	Critical10.0	—	0.5%	Oct 13, 2026
35Monitor	CVE-2025-46773No exploit	An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet Forfortinet · fortianalyzer cloud · CWE-89 RCE SQL injection	High8.8	—	0.3%	Oct 13, 2026
35Monitor	CVE-2025-57739No exploit	An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet Forfortinet · fortimail · CWE-89 SQL injection	High8.8	—	0.3%	Oct 13, 2026
35Monitor	CVE-2026-104085No exploit	odt2spip < 4.4.0 OS Command Injection via Document Filenameodt2spip · odt2spip · CWE-78 RCE Command injection	High8.7	—	1.9%	Oct 13, 2026
37Monitor	CVE-2026-105445Proof of concept	Docker Hub account conversion could reassign an active personal access token to another userdocker · docker hub · CWE-266	Critical9.4	—	0.4%	Oct 13, 2026
39Monitor	CVE-2026-106173Proof of concept	A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 alfortinet · fortisiem · CWE-22 Pre-auth Path traversal	Critical9.8	—	0.9%	Oct 13, 2026
35Monitor	CVE-2026-108375No exploit	dataclasses-avroschema allows code injection through generated field-default literalsmarcosschroh · dataclasses-avroschema · CWE-94 pre-auth RCE	High8.8	—	0.4%	Oct 13, 2026
35Monitor	CVE-2026-108376No exploit	dataclasses-avroschema allows code injection through record names in generated default factoriesmarcosschroh · dataclasses-avroschema · CWE-94 pre-auth RCE	High8.8	—	0.4%	Oct 13, 2026

CVE-2026-74033
33Monitor
Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
HighCVSS 8.4No exploitEPSS 0%
- Path traversal
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74034
34Monitor
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74035
34Monitor
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74036
34Monitor
Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
wazuh · wazuh-agentOct 13, 2026
CVE-2026-74037
34Monitor
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
HighCVSS 8.6No exploitEPSS 0%
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74040
37Monitor
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74041
34Monitor
Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
HighCVSS 8.6No exploitEPSS 0%
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74043
34Monitor
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74045
28Monitor
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
wazuh · wazuh-managerOct 13, 2026
CVE-2026-74047
28Monitor
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Info leak
wazuh · wazuh-managerOct 13, 2026
CVE-2026-93907
32Monitor
IBM WebSphere Application Server is affected by a bypass authentication vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · websphere application serverOct 13, 2026
CVE-2026-95680
32Monitor
IBM WebSphere Application Server is affected by an authorization bypass
HighCVSS 8.0No exploitEPSS 0%
- Auth bypass
ibm · websphere application serverOct 13, 2026
CVE-2026-102250
34Monitor
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an autho
HighCVSS 8.6No exploitEPSS 0%
schneider electric · sage rtu 1410Oct 13, 2026
CVE-2026-104192
38Monitor
DragonflyDB stream RDB deserialization double-free
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Deserialization
- Memory safety
dragonflydb · dragonflyOct 13, 2026
CVE-2026-107460
36Monitor
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
apache software foundation · apache fesod (incubating)Oct 13, 2026
CVE-2026-108184
29Monitor
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure v
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
zoom communications · zoom clientsOct 13, 2026
CVE-2026-108185
29Monitor
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
zoom communications · zoom clientsOct 13, 2026
CVE-2026-12655
35Monitor
1732E ArmorBlock® - Multiple Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
rockwell automation · 1732e armorblock® i/oOct 13, 2026
CVE-2026-12656
34Monitor
1732E ArmorBlock® - Multiple Vulnerabilities
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
rockwell automation · 1732e armorblock® i/oOct 13, 2026
CVE-2026-18228
28Monitor
Hyperscale Path Traversal
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
commvault · commvault cloudOct 13, 2026
CVE-2026-53418
32Monitor
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user
HighCVSS 8.1No exploitEPSS 0%
zoom communications · zoom workplaceOct 13, 2026
CVE-2026-53420
32Monitor
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via
HighCVSS 8.0No exploitEPSS 0%
- Memory safety
zoom communications · zoom workplaceOct 13, 2026
CVE-2026-53709
39Monitor
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · mcp-context-forgeOct 13, 2026
CVE-2026-65198
34Monitor
Huawei Default SNMPv3 USM key
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
huawei · openubmcOct 13, 2026
CVE-2026-77090
34Monitor
CVFS Information Disclosure
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- XXE
commvault · commvault cloudOct 13, 2026
CVE-2026-77093
28Monitor
CvFWD Denial of Service
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
commvault · commvault cloudOct 13, 2026
CVE-2026-77094
28Monitor
CvFWD Out-of-Bounds Write
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
commvault · commvault cloudOct 13, 2026
CVE-2026-77095
28Monitor
CvFWD Null Pointer Dereference
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
commvault · commvault cloudOct 13, 2026
CVE-2026-77096
30Monitor
CVFS Missing Authentication
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
commvault · commvault cloudOct 13, 2026
CVE-2026-77099
37Monitor
CVFS Command Execution
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Command injection
commvault · commvault cloudOct 13, 2026
CVE-2026-77100
34Monitor
MediaAgent Denial of Service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
commvault · commvault cloudOct 13, 2026
CVE-2026-95114
30Monitor
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Oct 13, 2026
CVE-2026-95115
30Monitor
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Oct 13, 2026
CVE-2026-95121
31Monitor
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp.
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
Oct 13, 2026
CVE-2026-95122
30Monitor
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Oct 13, 2026
CVE-2026-95124
30Monitor
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Oct 13, 2026
CVE-2026-95127
30Monitor
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 13, 2026
CVE-2026-97333
28Monitor
QAPI stack-based buffer overflow
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
commvault · commvault cloudOct 13, 2026
CVE-2026-97334
34Monitor
Network messaging layer decompression resource exhaustion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
commvault · commvault cloudOct 13, 2026
CVE-2024-34320
39Monitor
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 13, 2026
CVE-2024-34323
40Plan
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 13, 2026
CVE-2024-34324
36Monitor
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 13, 2026
CVE-2026-102699
30Monitor
Arm: multiple issues with GNTTABOP_cache_flush
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
xen · xenOct 13, 2026
CVE-2026-102702
30Monitor
Arm: multiple issues with GNTTABOP_cache_flush
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
xen · xenOct 13, 2026
CVE-2026-102982
34Monitor
Plane: XSS in work item comments
HighCVSS 8.5No exploitEPSS 0%
- XSS
makeplane · planeOct 13, 2026
CVE-2026-103928
37Monitor
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Path traversal
metabase · metabaseOct 13, 2026
CVE-2026-104004
28Monitor
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
mongodb · mongodb serverOct 13, 2026
CVE-2026-104005
28Monitor
Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
HighCVSS 7.1No exploitEPSS 0%
mongodb · mongodb serverOct 13, 2026
CVE-2026-104935
91Now
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
HighCVSS 8.6KEVWeaponizedEPSS 88%
- pre-auth RCE
- Auth bypass
ivanti · connect secureOct 13, 2026
CVE-2026-110025
27Monitor
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- File upload
- Broken access control (IDOR)
slackero · phpwcmsOct 13, 2026
CVE-2026-55376
35Monitor
heym Python Tool Sandbox Escape
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
heymrun · heymOct 13, 2026
CVE-2026-55675
40Plan
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
saltyorg · docsOct 13, 2026
CVE-2026-55695
36Monitor
FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
fearlessgeekmedia · fearlesscmsOct 13, 2026
CVE-2026-78802
39Monitor
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrar
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Oct 13, 2026
CVE-2026-79608
39Monitor
x86/AMD: ineffectual Zenbleed workaround
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
xen · xenOct 13, 2026
CVE-2026-79609
35Monitor
x86: XPTI may break on huge-memory systems
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
xen · xenOct 13, 2026
CVE-2026-79610
35Monitor
grant-table: double version change race
HighCVSS 8.8No exploitEPSS 0%
- Race condition
xen · xenOct 13, 2026
CVE-2026-96299
28Monitor
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
HighCVSS 7.1No exploitEPSS 0%
mongodb · mongodb serverOct 13, 2026
CVE-2026-102989
37Monitor
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
tanstack · routerOct 13, 2026
CVE-2026-103030
30Monitor
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
cfug · dioOct 13, 2026
CVE-2026-106042
39Monitor
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to r
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
ivanti · xtractionOct 13, 2026
CVE-2026-106043
30Monitor
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attac
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ivanti · xtractionOct 13, 2026
CVE-2026-106047
30Monitor
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
ivanti · xtractionOct 13, 2026
CVE-2026-109412
39Monitor
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication inf
CriticalCVSS 9.9No exploitEPSS 0%
ivanti · neurons patch for intuneOct 13, 2026
CVE-2026-110097
34Monitor
Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
ikaros-dev · ikarosOct 13, 2026
CVE-2026-110102
30Monitor
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
romkatv · powerlevel10kOct 13, 2026
CVE-2026-110104
32Monitor
novel through 3.5.0 Unsalted MD5 Password Storage
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
xxyopen · novelOct 13, 2026
CVE-2026-110108
34Monitor
MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
mateaix · matecloudOct 13, 2026
CVE-2026-110109
28Monitor
JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
jetlinks · jetlinks communityOct 13, 2026
CVE-2026-110115
34Monitor
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
risesoft-y9 · digital-infrastructureOct 13, 2026
CVE-2026-110116
35Monitor
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
risesoft-y9 · digital-infrastructureOct 13, 2026
CVE-2026-110117
28Monitor
SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
1024-lab · smartadminOct 13, 2026
CVE-2026-110118
28Monitor
WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
risesoft-y9 · workflow-engineOct 13, 2026
CVE-2026-110119
28Monitor
yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
guchengwuyue · yshopmallOct 13, 2026
CVE-2026-110121
28Monitor
PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
pickmall · lilishopOct 13, 2026
CVE-2026-110123
28Monitor
Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
makunet · maku-bootOct 13, 2026
CVE-2026-110124
34Monitor
FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
kerwincui · fastbeeOct 13, 2026
CVE-2026-110128
34Monitor
fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
fushengqian · fuintOct 13, 2026
CVE-2026-110129
28Monitor
fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
fushengqian · fuintcateringOct 13, 2026
CVE-2026-53562
34Monitor
Local Privilege Escalation
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
citrix · uniconosOct 13, 2026
CVE-2026-54454
36Monitor
OpenCATS: Authenticated RCE in the Import module
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- File upload
opencats · opencatsOct 13, 2026
CVE-2026-54640
30Monitor
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
HighCVSS 7.6No exploitEPSS 0%
- XXE
openremote · openremoteOct 13, 2026
CVE-2026-54641
30Monitor
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
openremote · openremoteOct 13, 2026
CVE-2026-55183
38Monitor
RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
zarestia-dev · rclone-managerOct 13, 2026
CVE-2026-55562
36Monitor
Cronicle: Stored XSS in admin Activity Log via account full_name field
CriticalCVSS 9.0No exploitEPSS 0%
- XSS
jhuckaby · cronicleOct 13, 2026
CVE-2026-55823
34Monitor
Frappe: Possibility of SQL injection in reportview
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
frappe · frappeOct 13, 2026
CVE-2026-61642
31Monitor
Squid Request Smuggling in HTTP Transfer-Encoding
HighCVSS 7.7No exploitEPSS 2%
squid-cache · squidOct 13, 2026
CVE-2026-69227
39Monitor
BUG-000187331 Portal for ArcGIS has a security vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
esri · portal for arcgisOct 13, 2026
CVE-2026-77459
39Monitor
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
argoproj · argo-cdOct 13, 2026
CVE-2026-78799
39Monitor
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router E
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Path traversal
Oct 13, 2026
CVE-2026-82416
30Monitor
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Race condition
php · frankenphpOct 13, 2026
CVE-2026-85990
35Monitor
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
HighCVSS 8.8No exploitEPSS 0%
leantime · leantimeOct 13, 2026
CVE-2026-94603
40Plan
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
podman-container-tools · podmanOct 13, 2026
CVE-2025-46773
35Monitor
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
fortinet · fortianalyzer cloudOct 13, 2026
CVE-2025-57739
35Monitor
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet For
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
fortinet · fortimailOct 13, 2026
CVE-2026-104085
35Monitor
odt2spip < 4.4.0 OS Command Injection via Document Filename
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Command injection
odt2spip · odt2spipOct 13, 2026
CVE-2026-105445
37Monitor
Docker Hub account conversion could reassign an active personal access token to another user
CriticalCVSS 9.4Proof of conceptEPSS 0%
docker · docker hubOct 13, 2026
CVE-2026-106173
39Monitor
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4 al
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
fortinet · fortisiemOct 13, 2026
CVE-2026-108375
35Monitor
dataclasses-avroschema allows code injection through generated field-default literals
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
marcosschroh · dataclasses-avroschemaOct 13, 2026
CVE-2026-108376
35Monitor
dataclasses-avroschema allows code injection through record names in generated default factories
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
marcosschroh · dataclasses-avroschemaOct 13, 2026