By publication date

Exploited and new serious CVEs: October 2026

8,249 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 39 of 83

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-97812No exploit	Windows Update Orchestrator Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 21h2 · CWE-415 Local privilege escalation Memory safety	High7.0	—	0.2%	Oct 13, 2026
39Monitor	CVE-2026-97814No exploit	Windows Text Shaping Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Oct 13, 2026
39Monitor	CVE-2026-97815No exploit	Windows Error Reporting Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	0.8%	Oct 13, 2026
39Monitor	CVE-2026-97816No exploit	Microsoft OpenSSH for Windows Remote Code Execution Vulnerabilitymicrosoft · windows 10 1809 · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Oct 13, 2026
30Monitor	CVE-2026-97830No exploit	Windows Internet Information Services Denial of Service Vulnerabilitymicrosoft · windows 11 23h2 · CWE-415 Pre-auth Memory safety Denial of service	High7.5	—	1.0%	Oct 13, 2026
29Monitor	CVE-2026-102234No exploit	Visual Studio Code Security Feature Bypass Vulnerabilitymicrosoft · visual studio code · CWE-807 Pre-auth	High7.4	—	0.8%	Oct 13, 2026
35Monitor	CVE-2026-102235No exploit	Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · visual studio code · CWE-116 pre-auth RCE	High8.8	—	0.7%	Oct 13, 2026
38Monitor	CVE-2026-102238No exploit	Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · visual studio code · CWE-22 pre-auth RCE Path traversal	Critical9.6	—	0.8%	Oct 13, 2026
35Monitor	CVE-2026-102855No exploit	Microsoft Office Visio Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.7%	Oct 13, 2026
31Monitor	CVE-2026-103830No exploit	Substance3D - Stager \| Stack-based Buffer Overflow (CWE-121)adobe · substance 3d stager · CWE-121 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103832No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103833No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103834No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103835No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103836No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103837No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103838No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103839No exploit	Substance3D - Stager \| Out-of-bounds Write (CWE-787)adobe · substance 3d stager · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103840No exploit	Substance3D - Stager \| Out-of-bounds Read (CWE-125)adobe · substance 3d stager · CWE-125 Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103841No exploit	Substance3D - Stager \| Out-of-bounds Read (CWE-125)adobe · substance 3d stager · CWE-125 Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103842No exploit	Substance3D - Stager \| Out-of-bounds Read (CWE-125)adobe · substance 3d stager · CWE-125 Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103843No exploit	Substance3D - Stager \| Use After Free (CWE-416)adobe · substance 3d stager · CWE-416 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103844No exploit	Dimension \| Out-of-bounds Write (CWE-787)adobe · adobe dimension · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-103845No exploit	Dimension \| Uncontrolled Search Path Element (CWE-427)adobe · adobe dimension · CWE-427 RCE	High8.6	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-103846No exploit	Dimension \| Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)adobe · adobe dimension · CWE-79 RCE XSS	High8.6	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-103847No exploit	Dimension \| Untrusted Search Path (CWE-426)adobe · adobe dimension · CWE-426 RCE	High8.6	—	0.1%	Oct 13, 2026
39Monitor	CVE-2026-103848No exploit	Adobe Experience Manager \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)adobe · adobe experience manager 6.5 lts · CWE-78 RCE Command injection	Critical9.9	—	1.4%	Oct 13, 2026
31Monitor	CVE-2026-103851No exploit	Substance3D - Stager \| Stack-based Buffer Overflow (CWE-121)adobe · adobe substance 3d stager · CWE-121 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-103854No exploit	Dimension \| Stack-based Buffer Overflow (CWE-121)adobe · adobe dimension · CWE-121 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
39Monitor	CVE-2026-104252No exploit	Vitess vttablet /twopcz reflected XSSlinuxfoundation · vitess · CWE-79 Pre-auth XSS	Critical9.8	—	1.1%	Oct 13, 2026
39Monitor	CVE-2026-104585Proof of concept	Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integratiCWE-77 pre-auth RCE Command injection	Critical9.8	—	1.4%	Oct 13, 2026
39Monitor	CVE-2026-105895No exploit	Adobe Experience Manager \| Improper Input Validation (CWE-20)adobe · experience manager · CWE-20 RCE	Critical9.9	—	0.7%	Oct 13, 2026
36Monitor	CVE-2026-106626No exploit	Adobe Experience Manager \| Improper Input Validation (CWE-20)adobe · experience manager · CWE-20 RCE	Critical9.1	—	0.7%	Oct 13, 2026
37Monitor	CVE-2026-106629No exploit	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)adobe · experience manager · CWE-79 Pre-auth XSS	Critical9.3	—	0.8%	Oct 13, 2026
37Monitor	CVE-2026-106630No exploit	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)adobe · experience manager · CWE-79 Pre-auth XSS	Critical9.3	—	0.8%	Oct 13, 2026
30Monitor	CVE-2026-106634No exploit	Adobe Experience Manager \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)adobe · experience manager · CWE-22 Path traversal	High7.7	—	0.4%	Oct 13, 2026
36Monitor	CVE-2026-110005No exploit	Moghtech Komodo contains an OS command injection vulnerabilitykomodo · komodo · CWE-78 RCE Command injection	High8.8	—	2.2%	Oct 13, 2026
28Monitor	CVE-2026-110083No exploit	Adobe Experience Manager \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)adobe · experience manager · CWE-89 SQL injection	High7.1	—	0.3%	Oct 13, 2026
28Monitor	CVE-2026-110084No exploit	Adobe Experience Manager \| XML Injection (aka Blind XPath Injection) (CWE-91)adobe · experience manager · CWE-91	High7.1	—	0.4%	Oct 13, 2026
35Monitor	CVE-2026-16753No exploit	Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated admlowcoder · lowcoder · CWE-639 Broken access control (IDOR)	High8.8	—	0.4%	Oct 13, 2026
40Plan	CVE-2026-48382No exploit	Adobe Experience Manager \| Incorrect Authorization (CWE-863)adobe · experience manager · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical10.0	—	0.9%	Oct 13, 2026
40Plan	CVE-2026-48383No exploit	Adobe Experience Manager \| Incorrect Authorization (CWE-863)adobe · experience manager · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical10.0	—	0.9%	Oct 13, 2026
29Monitor	CVE-2026-55601No exploit	MultiTail: Shell injection in execute-on-match command handlingfolkertvanheusden · multitail · CWE-78 RCE Command injection	High7.3	—	0.2%	Oct 13, 2026
37Monitor	CVE-2026-63146No exploit	Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.phpomnispace · agora project · CWE-94 pre-auth RCE SQL injection	Critical9.3	—	0.6%	Oct 13, 2026
36Monitor	CVE-2026-63149No exploit	Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()omnispace · agora project · CWE-330 Pre-auth Hard-coded credentials Weak crypto	Critical9.1	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-63152No exploit	Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilteromnispace · agora project · CWE-89 SQL injection	High8.6	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-63153No exploit	Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()omnispace · agora project · CWE-639 Broken access control (IDOR)	High8.6	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-63154No exploit	Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]omnispace · agora project · CWE-89 SQL injection	High8.7	—	0.4%	Oct 13, 2026
36Monitor	CVE-2026-63158No exploit	Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookiesomnispace · agora project · CWE-836 Pre-auth Auth bypass	Critical9.1	—	0.4%	Oct 13, 2026
36Monitor	CVE-2026-63159No exploit	Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeoveromnispace · agora project · CWE-640 Pre-auth	Critical9.1	—	0.3%	Oct 13, 2026
36Monitor	CVE-2026-63160No exploit	Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storageomnispace · agora project · CWE-522 Pre-auth Info leak	Critical9.1	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-63161No exploit	Omnispace Agora Project < 26.10.0 Session Fixation via Authenticationomnispace · agora project · CWE-384 Pre-auth	High8.6	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-63162No exploit	Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameteromnispace · agora project · CWE-22 RCE Path traversal	High8.7	—	0.7%	Oct 13, 2026
34Monitor	CVE-2026-63163No exploit	Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownloadomnispace · agora project · CWE-639 Pre-auth Broken access control (IDOR)	High8.7	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-63165No exploit	Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameteromnispace · agora project · CWE-89 SQL injection	High8.6	—	0.3%	Oct 13, 2026
28Monitor	CVE-2026-63172No exploit	Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Editomnispace · agora project · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-63174No exploit	Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectListomnispace · agora project · CWE-862 Broken access control (IDOR)	High8.6	—	0.2%	Oct 13, 2026
35Monitor	CVE-2026-70098No exploit	Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · visual studio code · CWE-862 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.5%	Oct 13, 2026
39Monitor	CVE-2026-75732No exploit	Adobe Experience Manager \| Incorrect Authorization (CWE-863)adobe · experience manager · CWE-863 RCE Broken access control (IDOR)	Critical9.9	—	0.7%	Oct 13, 2026
37Monitor	CVE-2026-83662No exploit	Adobe Experience Manager \| Cross-site Scripting (Reflected XSS) (CWE-79)adobe · experience manager · CWE-79 Pre-auth XSS	Critical9.3	—	1.0%	Oct 13, 2026
32Monitor	CVE-2026-86016No exploit	VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltrationvnotex · vnote · CWE-79 Pre-auth XSS	High8.2	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-86022No exploit	VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handlingvnotex · vnote · CWE-78 RCE Command injection	High7.0	—	0.2%	Oct 13, 2026
38Monitor	CVE-2026-90531No exploit	Adobe Experience Manager \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)adobe · experience manager · CWE-611 XXE	Critical9.6	—	1.4%	Oct 13, 2026
40Plan	CVE-2026-90532No exploit	Adobe Experience Manager \| Incorrect Authorization (CWE-863)adobe · experience manager · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical10.0	—	0.8%	Oct 13, 2026
31Monitor	CVE-2026-100111No exploit	Photoshop Desktop \| Out-of-bounds Write (CWE-787)adobe · photoshop · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-100112No exploit	Photoshop Desktop \| Out-of-bounds Write (CWE-787)adobe · photoshop · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-100127No exploit	Bridge \| Out-of-bounds Write (CWE-787)adobe · adobe bridge · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-100128No exploit	Bridge \| Out-of-bounds Write (CWE-787)adobe · adobe bridge · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-100129No exploit	Bridge \| Out-of-bounds Write (CWE-787)adobe · adobe bridge · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-101294No exploit	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic stepibm · websphere application server - liberty · CWE-325 Pre-auth	High8.7	—	0.2%	Oct 13, 2026
31Monitor	CVE-2026-103821No exploit	Substance3D - Designer \| Out-of-bounds Write (CWE-787)adobe · substance 3d designer · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-104346No exploit	Photoshop Desktop \| Out-of-bounds Write (CWE-787)adobe · photoshop · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-104347No exploit	Photoshop Desktop \| Out-of-bounds Write (CWE-787)adobe · photoshop · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
31Monitor	CVE-2026-104348No exploit	Photoshop Desktop \| Heap-based Buffer Overflow (CWE-122)adobe · photoshop · CWE-122 RCE Memory safety	High7.8	—	0.1%	Oct 13, 2026
21Monitor	CVE-2026-104587Proof of concept	blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability.CWE-79 RCE XSS	Medium5.4	—	0.2%	Oct 13, 2026
30Monitor	CVE-2026-105442No exploit	IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted dataibm · websphere application server · CWE-502 Pre-auth Deserialization Denial of service	High7.5	—	0.3%	Oct 13, 2026
32Monitor	CVE-2026-105443No exploit	IBM WebSphere Application Server Liberty is affected by an improper access controlibm · websphere application server - liberty · CWE-284 Broken access control (IDOR)	High8.2	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-105897No exploit	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918)adobe · coldfusion · CWE-918 Pre-auth SSRF	High8.6	—	0.6%	Oct 13, 2026
32Monitor	CVE-2026-105898No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High8.2	—	0.1%	Oct 13, 2026
40Plan	CVE-2026-105899No exploit	ColdFusion \| Unrestricted Upload of File with Dangerous Type (CWE-434)adobe · coldfusion · CWE-434 pre-auth RCE File upload	Critical10.0	—	1.0%	Oct 13, 2026
30Monitor	CVE-2026-105900No exploit	ColdFusion \| Improper Input Validation (CWE-20)adobe · coldfusion · CWE-20 Pre-auth Denial of service	High7.5	—	0.6%	Oct 13, 2026
35Monitor	CVE-2026-105901No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High8.8	—	0.1%	Oct 13, 2026
39Monitor	CVE-2026-105903No exploit	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · coldfusion · CWE-94 RCE	Critical9.9	—	0.6%	Oct 13, 2026
30Monitor	CVE-2026-105994No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 Broken access control (IDOR)	High7.7	—	0.3%	Oct 13, 2026
35Monitor	CVE-2026-106089No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High8.8	—	0.1%	Oct 13, 2026
35Monitor	CVE-2026-106090No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High8.8	—	0.1%	Oct 13, 2026
39Monitor	CVE-2026-106612No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Broken access control (IDOR)	Critical9.9	—	0.5%	Oct 13, 2026
35Monitor	CVE-2026-106613No exploit	ColdFusion \| Improper Input Validation (CWE-20)adobe · coldfusion · CWE-20 RCE	High8.8	—	0.8%	Oct 13, 2026
31Monitor	CVE-2026-106614No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Oct 13, 2026
35Monitor	CVE-2026-106615No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High8.8	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-106616No exploit	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)adobe · coldfusion · CWE-611 Pre-auth XXE	High8.6	—	0.5%	Oct 13, 2026
35Monitor	CVE-2026-106617No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High8.8	—	0.1%	Oct 13, 2026
35Monitor	CVE-2026-106618No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Local privilege escalation Broken access control (IDOR)	High8.8	—	0.1%	Oct 13, 2026
36Monitor	CVE-2026-106619No exploit	ColdFusion \| Improper Input Validation (CWE-20)adobe · coldfusion · CWE-20 pre-auth RCE	Critical9.0	—	0.5%	Oct 13, 2026
38Monitor	CVE-2026-106620No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 Broken access control (IDOR)	Critical9.6	—	0.4%	Oct 13, 2026
36Monitor	CVE-2026-106621No exploit	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · coldfusion · CWE-94 pre-auth RCE	Critical9.1	—	0.9%	Oct 13, 2026
40Plan	CVE-2026-106622No exploit	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918)adobe · coldfusion · CWE-918 Pre-auth SSRF	Critical10.0	—	0.7%	Oct 13, 2026
30Monitor	CVE-2026-106623No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Oct 13, 2026
40Plan	CVE-2026-106624No exploit	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · coldfusion · CWE-94 pre-auth RCE	Critical10.0	—	1.1%	Oct 13, 2026
30Monitor	CVE-2026-34633No exploit	ColdFusion \| Server-Side Request Forgery (SSRF) (CWE-918)adobe · coldfusion · CWE-918 SSRF	High7.7	—	0.4%	Oct 13, 2026

CVE-2026-97812
28Monitor
Windows Update Orchestrator Service Elevation of Privilege Vulnerability
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Memory safety
microsoft · windows 10 21h2Oct 13, 2026
CVE-2026-97814
39Monitor
Windows Text Shaping Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Oct 13, 2026
CVE-2026-97815
39Monitor
Windows Error Reporting Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Oct 13, 2026
CVE-2026-97816
39Monitor
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1809Oct 13, 2026
CVE-2026-97830
30Monitor
Windows Internet Information Services Denial of Service Vulnerability
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Memory safety
- Denial of service
microsoft · windows 11 23h2Oct 13, 2026
CVE-2026-102234
29Monitor
Visual Studio Code Security Feature Bypass Vulnerability
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
microsoft · visual studio codeOct 13, 2026
CVE-2026-102235
35Monitor
Visual Studio Code Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
microsoft · visual studio codeOct 13, 2026
CVE-2026-102238
38Monitor
Visual Studio Code Remote Code Execution Vulnerability
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Path traversal
microsoft · visual studio codeOct 13, 2026
CVE-2026-102855
35Monitor
Microsoft Office Visio Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · 365 appsOct 13, 2026
CVE-2026-103830
31Monitor
Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103832
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103833
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103834
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103835
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103836
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103837
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103838
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103839
31Monitor
Substance3D - Stager | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103840
31Monitor
Substance3D - Stager | Out-of-bounds Read (CWE-125)
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103841
31Monitor
Substance3D - Stager | Out-of-bounds Read (CWE-125)
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103842
31Monitor
Substance3D - Stager | Out-of-bounds Read (CWE-125)
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103843
31Monitor
Substance3D - Stager | Use After Free (CWE-416)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d stagerOct 13, 2026
CVE-2026-103844
31Monitor
Dimension | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · adobe dimensionOct 13, 2026
CVE-2026-103845
34Monitor
Dimension | Uncontrolled Search Path Element (CWE-427)
HighCVSS 8.6No exploitEPSS 0%
- RCE
adobe · adobe dimensionOct 13, 2026
CVE-2026-103846
34Monitor
Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)
HighCVSS 8.6No exploitEPSS 0%
- RCE
- XSS
adobe · adobe dimensionOct 13, 2026
CVE-2026-103847
34Monitor
Dimension | Untrusted Search Path (CWE-426)
HighCVSS 8.6No exploitEPSS 0%
- RCE
adobe · adobe dimensionOct 13, 2026
CVE-2026-103848
39Monitor
Adobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
CriticalCVSS 9.9No exploitEPSS 1%
- RCE
- Command injection
adobe · adobe experience manager 6.5 ltsOct 13, 2026
CVE-2026-103851
31Monitor
Substance3D - Stager | Stack-based Buffer Overflow (CWE-121)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · adobe substance 3d stagerOct 13, 2026
CVE-2026-103854
31Monitor
Dimension | Stack-based Buffer Overflow (CWE-121)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · adobe dimensionOct 13, 2026
CVE-2026-104252
39Monitor
Vitess vttablet /twopcz reflected XSS
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- XSS
linuxfoundation · vitessOct 13, 2026
CVE-2026-104585
39Monitor
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integrati
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
Oct 13, 2026
CVE-2026-105895
39Monitor
Adobe Experience Manager | Improper Input Validation (CWE-20)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
adobe · experience managerOct 13, 2026
CVE-2026-106626
36Monitor
Adobe Experience Manager | Improper Input Validation (CWE-20)
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
adobe · experience managerOct 13, 2026
CVE-2026-106629
37Monitor
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
adobe · experience managerOct 13, 2026
CVE-2026-106630
37Monitor
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
adobe · experience managerOct 13, 2026
CVE-2026-106634
30Monitor
Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
adobe · experience managerOct 13, 2026
CVE-2026-110005
36Monitor
Moghtech Komodo contains an OS command injection vulnerability
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
komodo · komodoOct 13, 2026
CVE-2026-110083
28Monitor
Adobe Experience Manager | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
adobe · experience managerOct 13, 2026
CVE-2026-110084
28Monitor
Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
HighCVSS 7.1No exploitEPSS 0%
adobe · experience managerOct 13, 2026
CVE-2026-16753
35Monitor
Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated adm
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
lowcoder · lowcoderOct 13, 2026
CVE-2026-48382
40Plan
Adobe Experience Manager | Incorrect Authorization (CWE-863)
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
adobe · experience managerOct 13, 2026
CVE-2026-48383
40Plan
Adobe Experience Manager | Incorrect Authorization (CWE-863)
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
adobe · experience managerOct 13, 2026
CVE-2026-55601
29Monitor
MultiTail: Shell injection in execute-on-match command handling
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Command injection
folkertvanheusden · multitailOct 13, 2026
CVE-2026-63146
37Monitor
Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SQL injection
omnispace · agora projectOct 13, 2026
CVE-2026-63149
36Monitor
Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
- Weak crypto
omnispace · agora projectOct 13, 2026
CVE-2026-63152
34Monitor
Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
omnispace · agora projectOct 13, 2026
CVE-2026-63153
34Monitor
Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
omnispace · agora projectOct 13, 2026
CVE-2026-63154
34Monitor
Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
omnispace · agora projectOct 13, 2026
CVE-2026-63158
36Monitor
Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
omnispace · agora projectOct 13, 2026
CVE-2026-63159
36Monitor
Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
omnispace · agora projectOct 13, 2026
CVE-2026-63160
36Monitor
Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Info leak
omnispace · agora projectOct 13, 2026
CVE-2026-63161
34Monitor
Omnispace Agora Project < 26.10.0 Session Fixation via Authentication
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
omnispace · agora projectOct 13, 2026
CVE-2026-63162
34Monitor
Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
omnispace · agora projectOct 13, 2026
CVE-2026-63163
34Monitor
Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
omnispace · agora projectOct 13, 2026
CVE-2026-63165
34Monitor
Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
omnispace · agora projectOct 13, 2026
CVE-2026-63172
28Monitor
Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
omnispace · agora projectOct 13, 2026
CVE-2026-63174
34Monitor
Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
omnispace · agora projectOct 13, 2026
CVE-2026-70098
35Monitor
Visual Studio Code Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
microsoft · visual studio codeOct 13, 2026
CVE-2026-75732
39Monitor
Adobe Experience Manager | Incorrect Authorization (CWE-863)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
adobe · experience managerOct 13, 2026
CVE-2026-83662
37Monitor
Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- XSS
adobe · experience managerOct 13, 2026
CVE-2026-86016
32Monitor
VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- XSS
vnotex · vnoteOct 13, 2026
CVE-2026-86022
28Monitor
VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Command injection
vnotex · vnoteOct 13, 2026
CVE-2026-90531
38Monitor
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
CriticalCVSS 9.6No exploitEPSS 1%
- XXE
adobe · experience managerOct 13, 2026
CVE-2026-90532
40Plan
Adobe Experience Manager | Incorrect Authorization (CWE-863)
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
adobe · experience managerOct 13, 2026
CVE-2026-100111
31Monitor
Photoshop Desktop | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · photoshopOct 13, 2026
CVE-2026-100112
31Monitor
Photoshop Desktop | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · photoshopOct 13, 2026
CVE-2026-100127
31Monitor
Bridge | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · adobe bridgeOct 13, 2026
CVE-2026-100128
31Monitor
Bridge | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · adobe bridgeOct 13, 2026
CVE-2026-100129
31Monitor
Bridge | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · adobe bridgeOct 13, 2026
CVE-2026-101294
34Monitor
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
ibm · websphere application server - libertyOct 13, 2026
CVE-2026-103821
31Monitor
Substance3D - Designer | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · substance 3d designerOct 13, 2026
CVE-2026-104346
31Monitor
Photoshop Desktop | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · photoshopOct 13, 2026
CVE-2026-104347
31Monitor
Photoshop Desktop | Out-of-bounds Write (CWE-787)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · photoshopOct 13, 2026
CVE-2026-104348
31Monitor
Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
adobe · photoshopOct 13, 2026
CVE-2026-104587
21Monitor
blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability.
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- XSS
Oct 13, 2026
CVE-2026-105442
30Monitor
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Deserialization
- Denial of service
ibm · websphere application serverOct 13, 2026
CVE-2026-105443
32Monitor
IBM WebSphere Application Server Liberty is affected by an improper access control
HighCVSS 8.2No exploitEPSS 0%
- Broken access control (IDOR)
ibm · websphere application server - libertyOct 13, 2026
CVE-2026-105897
34Monitor
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SSRF
adobe · coldfusionOct 13, 2026
CVE-2026-105898
32Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-105899
40Plan
ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- File upload
adobe · coldfusionOct 13, 2026
CVE-2026-105900
30Monitor
ColdFusion | Improper Input Validation (CWE-20)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
adobe · coldfusionOct 13, 2026
CVE-2026-105901
35Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-105903
39Monitor
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
adobe · coldfusionOct 13, 2026
CVE-2026-105994
30Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106089
35Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106090
35Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106612
39Monitor
ColdFusion | Incorrect Authorization (CWE-863)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106613
35Monitor
ColdFusion | Improper Input Validation (CWE-20)
HighCVSS 8.8No exploitEPSS 0%
- RCE
adobe · coldfusionOct 13, 2026
CVE-2026-106614
31Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106615
35Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106616
34Monitor
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XXE
adobe · coldfusionOct 13, 2026
CVE-2026-106617
35Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106618
35Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106619
36Monitor
ColdFusion | Improper Input Validation (CWE-20)
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
adobe · coldfusionOct 13, 2026
CVE-2026-106620
38Monitor
ColdFusion | Incorrect Authorization (CWE-863)
CriticalCVSS 9.6No exploitEPSS 0%
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106621
36Monitor
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
adobe · coldfusionOct 13, 2026
CVE-2026-106622
40Plan
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- SSRF
adobe · coldfusionOct 13, 2026
CVE-2026-106623
30Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
adobe · coldfusionOct 13, 2026
CVE-2026-106624
40Plan
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
adobe · coldfusionOct 13, 2026
CVE-2026-34633
30Monitor
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
HighCVSS 7.7No exploitEPSS 0%
- SSRF
adobe · coldfusionOct 13, 2026