By publication date

Exploited and new serious CVEs: October 2026

8,745 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 41 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-88964No exploit	An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a deniaopenvpn · openvpn · CWE-125 Memory safety	High7.1	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-92817No exploit	Inductive Automation Ignition Software Incorrect Authorizationinductive automation · ignition · CWE-863 RCE Broken access control (IDOR)	High8.7	—	0.4%	Oct 14, 2026
34Monitor	CVE-2026-108473No exploit	Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devicestp-link systems inc. · hs103 v5 · CWE-306 Pre-auth Auth bypass	High8.7	—	0.2%	Oct 14, 2026
31Monitor	CVE-2026-110359No exploit	Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.hyland · desktop host · CWE-276 Local privilege escalation	High7.8	—	0.1%	Oct 14, 2026
34Monitor	CVE-2026-110385No exploit	A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inboonlyoffice · document server · CWE-73 RCE Path traversal	High8.7	—	1.0%	Oct 14, 2026
30Monitor	CVE-2026-103423No exploit	Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'pubmasaakitanaka · booking package · CWE-862 Pre-auth Broken access control (IDOR) CSRF	High7.5	—	0.5%	Oct 14, 2026
30Monitor	CVE-2026-104749No exploit	Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Cbitpressadmin · bit integrations – form integration, webhook, spreadsheets, crm, lms & email automation · CWE-269 Pre-auth	High7.5	—	0.5%	Oct 14, 2026
30Monitor	CVE-2026-104767No exploit	Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cachedavefx · membership & user roles for woocommerce (automatic role changer) · CWE-269	High7.5	—	0.3%	Oct 14, 2026
32Monitor	CVE-2026-104995No exploit	BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Valuedontdream · bp profile search · CWE-98 pre-auth RCE	High8.1	—	1.1%	Oct 14, 2026
39Monitor	CVE-2026-110392No exploit	Samsung QA-Board — Unauthenticated OS command injection via output redo/tuningsamsung open source · qa-board · CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.2%	Oct 14, 2026
32Monitor	CVE-2026-17092No exploit	Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletwpwax · directorist: ai-powered business directory, listings & classified ads · CWE-862 Broken access control (IDOR)	High8.1	—	0.5%	Oct 14, 2026
31Monitor	CVE-2026-82715No exploit	Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Serverhitachi · hitachi disk array driver for aix · CWE-377	High7.9	—	0.1%	Oct 14, 2026
36Monitor	CVE-2026-92097No exploit	Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholderholithemes · click to chat – holithemes · CWE-94 pre-auth RCE	Critical9.1	—	0.5%	Oct 14, 2026
39Monitor	CVE-2026-93388No exploit	Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesprintcart · printcart store – web to print product designer for woocommerce · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.8%	Oct 14, 2026
30Monitor	CVE-2026-102251No exploit	Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parametertyche softwares · abandoned cart pro for woocommerce · CWE-89 Pre-auth SQL injection	High7.5	—	0.3%	Oct 14, 2026
28Monitor	CVE-2026-103422No exploit	AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameterateshabaev · anycomment · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
39Monitor	CVE-2026-110002No exploit	Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parametersnazzyplugins · snazzy social media feed · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.9%	Oct 14, 2026
34Monitor	CVE-2026-110444No exploit	TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injectionteamplus technology · teamplus messenger · CWE-94 pre-auth RCE	High8.6	—	0.5%	Oct 14, 2026
34Monitor	CVE-2026-110445No exploit	TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injectionteamplus technology · teamplus messenger · CWE-94 pre-auth RCE	High8.6	—	0.5%	Oct 14, 2026
88Now	CVE-2026-110447Weaponized	Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in thcollabora · collabora online - built-in code server · CWE-78 pre-auth RCE Command injection	Critical9.2	KEV	73.3%	Oct 14, 2026
30Monitor	CVE-2026-14765No exploit	Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURLepic games · unreal engine · CWE-1188 RCE	High7.7	—	0.3%	Oct 14, 2026
39Monitor	CVE-2026-97657Proof of concept	Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Ptyche softwares · abandoned cart pro for woocommerce · CWE-639 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.8	—	0.4%	Oct 14, 2026
39Monitor	CVE-2026-97668No exploit	Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_valuetyche softwares · abandoned cart pro for woocommerce · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.4%	Oct 14, 2026
28Monitor	CVE-2026-100153No exploit	NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)ice00 · newstatpress · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
39Monitor	CVE-2026-104800No exploit	AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.phpstreetforce1 · age-gate · CWE-434 pre-auth RCE Auth bypass File upload	Critical9.8	—	1.0%	Oct 14, 2026
30Monitor	CVE-2026-110449No exploit	Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions becnixos · nix · CWE-190 Pre-auth Memory safety	High7.5	—	0.2%	Oct 14, 2026
28Monitor	CVE-2026-77114No exploit	Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scriptingdanrossiter · document gallery · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
30Monitor	CVE-2026-78193No exploit	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injectionntbyk · jtl-connector for woocommerce · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	Oct 14, 2026
28Monitor	CVE-2026-83592No exploit	Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Valuesdoctorwp · contact form db for enfold · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
39Monitor	CVE-2026-87855No exploit	JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Methodntbyk · jtl-connector for woocommerce · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.7%	Oct 14, 2026
28Monitor	CVE-2026-93885No exploit	Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameterblackworks1 · cryptocurrency donation box – bitcoin & crypto donations · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
28Monitor	CVE-2026-94377No exploit	Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)avisverifies · verified reviews (avis vérifiés) · CWE-79 Pre-auth Auth bypass XSS	High7.2	—	0.3%	Oct 14, 2026
30Monitor	CVE-2026-95808No exploit	Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter10web · form maker by 10web – mobile-friendly drag & drop contact form builder · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	Oct 14, 2026
28Monitor	CVE-2026-95816No exploit	Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameteredgarrojas · smart forms – when you need more than just a contact form · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
30Monitor	CVE-2026-96661No exploit	Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameterpasyuk · gmedia photo gallery · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	Oct 14, 2026
28Monitor	CVE-2026-97398No exploit	FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attributefoliovision · fv flowplayer video player · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
28Monitor	CVE-2026-101924No exploit	NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query Stringice00 · newstatpress · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
35Monitor	CVE-2026-105429No exploit	NetBird client SSH config Match line injection via peer FQDN or hostname allows local command executionnetbird · netbird · CWE-78 RCE Command injection	High8.9	—	0.5%	Oct 14, 2026
65This week	CVE-2026-106931Weaponized	SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with re-guardian · siteguard · CWE-78 RCE Local privilege escalation Command injection	High8.5	KEV	2.5%	Oct 14, 2026
32Monitor	CVE-2026-110450No exploit	Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store nixos · nix · CWE-696 Local privilege escalation	High8.0	—	0.1%	Oct 14, 2026
32Monitor	CVE-2026-110455No exploit	A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in ubiquiti inc · unifi protect ai key · CWE-20 pre-auth RCE Command injection	High8.1	—	1.2%	Oct 14, 2026
28Monitor	CVE-2026-107153No exploit	Multiple smartphones provided by Rakuten Mobile, Inc.rakuten mobile, inc. · rakuten mini · CWE-1391	High7.0	—	0.1%	Oct 14, 2026
34Monitor	CVE-2026-110459No exploit	A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain ubiquiti inc · unifi protect ai key · CWE-284 Pre-auth Broken access control (IDOR)	High8.6	—	0.2%	Oct 14, 2026
34Monitor	CVE-2026-50218No exploit	Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.akamai · guardicore platform agent · CWE-99	High8.5	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-103307No exploit	Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhookunknown · walletdoc payment gateway for woocommerce · CWE-89 Pre-auth SQL injection	High8.6	—	0.3%	Oct 14, 2026
35Monitor	CVE-2026-107126No exploit	WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Headerunknown · wp booking system · CWE-79 Pre-auth XSS	High8.8	—	0.4%	Oct 14, 2026
34Monitor	CVE-2026-107508No exploit	Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameterunknown · ultimate multisite · CWE-22 Pre-auth Path traversal	High8.6	—	0.5%	Oct 14, 2026
40Plan	CVE-2026-107594No exploit	File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletionunknown · file upload to order · CWE-73 Pre-auth Path traversal	Critical10.0	—	0.4%	Oct 14, 2026
28Monitor	CVE-2026-86787No exploit	Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directiveunknown · affiliate-toolkit · CWE-94 RCE	High7.2	—	0.3%	Oct 14, 2026
35Monitor	CVE-2026-86799No exploit	Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submissionunknown · forms · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-89288No exploit	Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameterunknown · fast courier · CWE-89 Pre-auth SQL injection	High8.6	—	0.3%	Oct 14, 2026
37Monitor	CVE-2026-89310No exploit	SQL Command Injection Vulnerability in JTL-WMSjtl sw gmbh · jtl-wms · CWE-89 RCE SQL injection Command injection	Critical9.4	—	0.4%	Oct 14, 2026
29Monitor	CVE-2026-100163No exploit	Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_cuslatepoint · appointment booking plugin – latepoint \| calendar & scheduling for wordpress · CWE-287 Pre-auth Auth bypass	High7.4	—	0.4%	Oct 14, 2026
30Monitor	CVE-2026-103366No exploit	Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Paralatepoint · appointment booking plugin – latepoint \| calendar & scheduling for wordpress · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Oct 14, 2026
32Monitor	CVE-2026-103367No exploit	ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameterwpdesk · shopmagic – email automation for wordpress · CWE-98 pre-auth RCE	High8.1	—	1.0%	Oct 14, 2026
39Monitor	CVE-2026-104748Proof of concept	SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_registerwpazleen · simpleform – form maker to chat apps with quiz, poll and multi lead notifications · CWE-269 Pre-auth	Critical9.8	—	0.8%	Oct 14, 2026
28Monitor	CVE-2026-104764No exploit	Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameterwpazleen · post export import with media · CWE-502 Deserialization	High7.2	—	0.6%	Oct 14, 2026
32Monitor	CVE-2026-104909No exploit	Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameterkitae-park · mang board · CWE-98 pre-auth RCE	High8.1	—	1.0%	Oct 14, 2026
36Monitor	CVE-2026-105106No exploit	Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled taskkoha community · koha · CWE-78 RCE Command injection	High8.8	—	1.8%	Oct 14, 2026
28Monitor	CVE-2026-105107No exploit	Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameterskoha community · koha · CWE-89 SQL injection	High7.2	—	0.2%	Oct 14, 2026
28Monitor	CVE-2026-107631No exploit	Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameterdavidevalerio · record of consent extension for complianz · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
28Monitor	CVE-2026-107751No exploit	Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameterkitae-park · mang board · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-109901No exploit	WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerabilitycodepeople · cp multi view event calendar · CWE-89 SQL injection	High8.5	—	0.2%	Oct 14, 2026
30Monitor	CVE-2026-110284No exploit	LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributeslifterlms · lifterlms – wp lms for elearning, online courses, & quizzes · CWE-98 RCE	High7.5	—	0.6%	Oct 14, 2026
32Monitor	CVE-2026-92392Proof of concept	HTTP/2 upload Use-After-Freecurl · curl · CWE-416 Pre-auth Memory safety	High8.1	—	1.2%	Oct 14, 2026
28Monitor	CVE-2026-107428No exploit	WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerabilityvideowhisper.com · paid videochat turnkey site · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 14, 2026
36Monitor	CVE-2026-14851No exploit	Unauthorised disclosure of information on Copart’s online billing servicecopart · copart’s online billing service · CWE-200 Pre-auth Info leak	Critical9.2	—	0.3%	Oct 14, 2026
32Monitor	CVE-2026-73790No exploit	HPE NonStop iTP WebServer - Memory corruption vulnerabilityhewlett packard enterprise · hpe nonstop itp webserver · CWE-20 Pre-auth	High8.2	—	0.3%	Oct 14, 2026
31Monitor	CVE-2026-73793No exploit	HPE NonStop Middleware - Secret key handling vulnerabilityhewlett packard enterprise · hpe nonstop middleware · CWE-502 Deserialization	High7.9	—	0.2%	Oct 14, 2026
33Monitor	CVE-2026-86476Proof of concept	Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserializered hat · red hat enterprise linux 10 · CWE-787 Deserialization Memory safety	High8.4	—	0.1%	Oct 14, 2026
28Monitor	CVE-2026-88829No exploit	Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxyred hat · red hat hardened images · CWE-444 Pre-auth	High7.2	—	0.2%	Oct 14, 2026
31Monitor	CVE-2026-90954No exploit	Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flushred hat · red hat hardened images · CWE-59	High7.8	—	0.2%	Oct 14, 2026
34Monitor	CVE-2026-101337No exploit	Stack overwrite from specially formatted base64 RDATA fieldnlnet labs · nsd · CWE-121 Memory safety	High8.7	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-101338No exploit	Stack overwrite from a specially crafted and formatted SVCB or HTTPS RRnlnet labs · nsd · CWE-121 Memory safety	High8.7	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-101339No exploit	Stack overwrite from a specially crafted and formatted HIP RRnlnet labs · nsd · CWE-121 Memory safety	High8.7	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-101341No exploit	Stack overwrite from specially formatted TXT-DATA RDATA fieldnlnet labs · nsd · CWE-121 Memory safety	High8.7	—	0.3%	Oct 14, 2026
30Monitor	CVE-2026-103358No exploit	WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerabilityvillatheme · email template customizer for woocommerce · CWE-94 pre-auth RCE	High7.5	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-103904No exploit	Stored XSS Vulnerability in JTL-Shopjtl-software gmbh · jtl-shop · CWE-79 Pre-auth XSS	High8.6	—	0.4%	Oct 14, 2026
34Monitor	CVE-2026-103905No exploit	Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shopjtl-software gmbh · jtl-shop · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Oct 14, 2026
35Monitor	CVE-2026-104795No exploit	Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary executionred hat · red hat openshift container platform 4 · CWE-250 Local privilege escalation	High8.8	—	0.1%	Oct 14, 2026
34Monitor	CVE-2026-105067No exploit	WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerabilitywebnus · modern events calendar lite · CWE-89 SQL injection	High8.5	—	0.2%	Oct 14, 2026
30Monitor	CVE-2026-107431No exploit	WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerabilitycrocoblock · jetformbuilder · CWE-862 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.3%	Oct 14, 2026
34Monitor	CVE-2026-108070No exploit	Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Accesstsplus · tsplus remote access · CWE-552 Pre-auth	High8.7	—	0.4%	Oct 14, 2026
34Monitor	CVE-2026-108071No exploit	Improper Multi-Factor Authentication Validation Allows Authentication Bypasstsplus · tsplus remote access · CWE-304 Auth bypass	High8.7	—	0.4%	Oct 14, 2026
30Monitor	RUSTSEC-2026-0365No exploit	Remote DoS through unchecked `IdList` allocation in negentropy Pre-auth Denial of service	High7.5	—	—	Oct 14, 2026
32Monitor	CVE-2026-73798No exploit	HPE NonStop DNS 9.2.3 Non Secure Versionhewlett packard enterprise · hpe nonstop dns 9.2.3 non secure version · CWE-115 Pre-auth	High8.2	—	0.3%	Oct 14, 2026
30Monitor	CVE-2026-76655No exploit	HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerabilityhewlett packard enterprise · hpe nonstop snmp trap multiplexer · CWE-121 pre-auth RCE Memory safety Denial of service	High7.5	—	0.5%	Oct 14, 2026
29Monitor	CVE-2026-85298No exploit	Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalationgoogle cloud · application integration · CWE-863 Broken access control (IDOR)	High7.3	—	0.3%	Oct 14, 2026
28Monitor	CVE-2026-105874No exploit	WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerabilitybrainstorm force · surecart · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 14, 2026
35Monitor	CVE-2026-106599No exploit	WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerabilitybrainstorm force · surecart · CWE-502 Deserialization	High8.8	—	0.4%	Oct 14, 2026
29Monitor	CVE-2026-107421No exploit	WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerabilityvideowhisper.com · broadcast live video · CWE-384 Pre-auth	High7.3	—	0.2%	Oct 14, 2026
39Monitor	CVE-2026-107424No exploit	WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerabilitym a vinoth kumar · frontend dashboard · CWE-266 Pre-auth	Critical9.8	—	0.3%	Oct 14, 2026
29Monitor	CVE-2026-107426No exploit	WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerabilityvideowhisper.com · paid videochat turnkey site · CWE-862 Pre-auth Broken access control (IDOR)	High7.3	—	0.2%	Oct 14, 2026
28Monitor	CVE-2026-107867No exploit	WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilitycrocoblock · jetproducttables · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 14, 2026
39Monitor	CVE-2026-108291No exploit	WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerabilityitthinx · affiliates · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 14, 2026
40Plan	CVE-2026-16740No exploit	Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASPtr7 cyber defense inc. · tr7 asp · CWE-306 pre-auth RCE Auth bypass Command injection	Critical9.8	—	1.6%	Oct 14, 2026
40Plan	CVE-2026-16741No exploit	OS Command in TR7 Cyber Defense's TR7 ASPtr7 cyber defense inc. · tr7 asp · CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.6%	Oct 14, 2026
34Monitor	CVE-2026-82026No exploit	Radar < 1.12.2 Missing Authorization via /api/local-terminalskyhook-io · radar · CWE-862 RCE Broken access control (IDOR)	High8.7	—	0.9%	Oct 14, 2026
28Monitor	CVE-2026-97278No exploit	WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerabilitywp syntex · polylang · CWE-502 Deserialization	High7.2	—	0.4%	Oct 14, 2026
28Monitor	CVE-2026-107870No exploit	WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerabilitycrocoblock · jetengine · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 14, 2026

CVE-2026-88964
28Monitor
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denia
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
openvpn · openvpnOct 13, 2026
CVE-2026-92817
34Monitor
Inductive Automation Ignition Software Incorrect Authorization
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
inductive automation · ignitionOct 14, 2026
CVE-2026-108473
34Monitor
Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
tp-link systems inc. · hs103 v5Oct 14, 2026
CVE-2026-110359
31Monitor
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
hyland · desktop hostOct 14, 2026
CVE-2026-110385
34Monitor
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbo
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Path traversal
onlyoffice · document serverOct 14, 2026
CVE-2026-103423
30Monitor
Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'pub
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- CSRF
masaakitanaka · booking packageOct 14, 2026
CVE-2026-104749
30Monitor
Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-C
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
bitpressadmin · bit integrations – form integration, webhook, spreadsheets, crm, lms & email automationOct 14, 2026
CVE-2026-104767
30Monitor
Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
HighCVSS 7.5No exploitEPSS 0%
davefx · membership & user roles for woocommerce (automatic role changer)Oct 14, 2026
CVE-2026-104995
32Monitor
BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
HighCVSS 8.1No exploitEPSS 1%
- pre-auth RCE
dontdream · bp profile searchOct 14, 2026
CVE-2026-110392
39Monitor
Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
samsung open source · qa-boardOct 14, 2026
CVE-2026-17092
32Monitor
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Delet
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
wpwax · directorist: ai-powered business directory, listings & classified adsOct 14, 2026
CVE-2026-82715
31Monitor
Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server
HighCVSS 7.9No exploitEPSS 0%
hitachi · hitachi disk array driver for aixOct 14, 2026
CVE-2026-92097
36Monitor
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
holithemes · click to chat – holithemesOct 14, 2026
CVE-2026-93388
39Monitor
Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdes
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
printcart · printcart store – web to print product designer for woocommerceOct 14, 2026
CVE-2026-102251
30Monitor
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
tyche softwares · abandoned cart pro for woocommerceOct 14, 2026
CVE-2026-103422
28Monitor
AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
ateshabaev · anycommentOct 14, 2026
CVE-2026-110002
39Monitor
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
snazzyplugins · snazzy social media feedOct 14, 2026
CVE-2026-110444
34Monitor
TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
teamplus technology · teamplus messengerOct 14, 2026
CVE-2026-110445
34Monitor
TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
teamplus technology · teamplus messengerOct 14, 2026
CVE-2026-110447
88Now
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in th
CriticalCVSS 9.2KEVWeaponizedEPSS 73%
- pre-auth RCE
- Command injection
collabora · collabora online - built-in code serverOct 14, 2026
CVE-2026-14765
30Monitor
Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL
HighCVSS 7.7No exploitEPSS 0%
- RCE
epic games · unreal engineOct 14, 2026
CVE-2026-97657
39Monitor
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' P
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
tyche softwares · abandoned cart pro for woocommerceOct 14, 2026
CVE-2026-97668
39Monitor
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
tyche softwares · abandoned cart pro for woocommerceOct 14, 2026
CVE-2026-100153
28Monitor
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
ice00 · newstatpressOct 14, 2026
CVE-2026-104800
39Monitor
AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
- File upload
streetforce1 · age-gateOct 14, 2026
CVE-2026-110449
30Monitor
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions bec
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
nixos · nixOct 14, 2026
CVE-2026-77114
28Monitor
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
danrossiter · document galleryOct 14, 2026
CVE-2026-78193
30Monitor
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
ntbyk · jtl-connector for woocommerceOct 14, 2026
CVE-2026-83592
28Monitor
Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
doctorwp · contact form db for enfoldOct 14, 2026
CVE-2026-87855
39Monitor
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
ntbyk · jtl-connector for woocommerceOct 14, 2026
CVE-2026-93885
28Monitor
Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
blackworks1 · cryptocurrency donation box – bitcoin & crypto donationsOct 14, 2026
CVE-2026-94377
28Monitor
Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- XSS
avisverifies · verified reviews (avis vérifiés)Oct 14, 2026
CVE-2026-95808
30Monitor
Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
10web · form maker by 10web – mobile-friendly drag & drop contact form builderOct 14, 2026
CVE-2026-95816
28Monitor
Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
edgarrojas · smart forms – when you need more than just a contact formOct 14, 2026
CVE-2026-96661
30Monitor
Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
pasyuk · gmedia photo galleryOct 14, 2026
CVE-2026-97398
28Monitor
FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
foliovision · fv flowplayer video playerOct 14, 2026
CVE-2026-101924
28Monitor
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
ice00 · newstatpressOct 14, 2026
CVE-2026-105429
35Monitor
NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution
HighCVSS 8.9No exploitEPSS 0%
- RCE
- Command injection
netbird · netbirdOct 14, 2026
CVE-2026-106931
65This week
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with r
HighCVSS 8.5KEVWeaponizedEPSS 2%
- RCE
- Local privilege escalation
- Command injection
e-guardian · siteguardOct 14, 2026
CVE-2026-110450
32Monitor
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store
HighCVSS 8.0No exploitEPSS 0%
- Local privilege escalation
nixos · nixOct 14, 2026
CVE-2026-110455
32Monitor
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in
HighCVSS 8.1No exploitEPSS 1%
- pre-auth RCE
- Command injection
ubiquiti inc · unifi protect ai keyOct 14, 2026
CVE-2026-107153
28Monitor
Multiple smartphones provided by Rakuten Mobile, Inc.
HighCVSS 7.0No exploitEPSS 0%
rakuten mobile, inc. · rakuten miniOct 14, 2026
CVE-2026-110459
34Monitor
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ubiquiti inc · unifi protect ai keyOct 14, 2026
CVE-2026-50218
34Monitor
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.
HighCVSS 8.5No exploitEPSS 0%
akamai · guardicore platform agentOct 14, 2026
CVE-2026-103307
34Monitor
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · walletdoc payment gateway for woocommerceOct 14, 2026
CVE-2026-107126
35Monitor
WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · wp booking systemOct 14, 2026
CVE-2026-107508
34Monitor
Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
unknown · ultimate multisiteOct 14, 2026
CVE-2026-107594
40Plan
File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Path traversal
unknown · file upload to orderOct 14, 2026
CVE-2026-86787
28Monitor
Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive
HighCVSS 7.2No exploitEPSS 0%
- RCE
unknown · affiliate-toolkitOct 14, 2026
CVE-2026-86799
35Monitor
Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · formsOct 14, 2026
CVE-2026-89288
34Monitor
Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · fast courierOct 14, 2026
CVE-2026-89310
37Monitor
SQL Command Injection Vulnerability in JTL-WMS
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- SQL injection
- Command injection
jtl sw gmbh · jtl-wmsOct 14, 2026
CVE-2026-100163
29Monitor
Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_cus
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpressOct 14, 2026
CVE-2026-103366
30Monitor
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Para
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpressOct 14, 2026
CVE-2026-103367
32Monitor
ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
HighCVSS 8.1No exploitEPSS 1%
- pre-auth RCE
wpdesk · shopmagic – email automation for wordpressOct 14, 2026
CVE-2026-104748
39Monitor
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
wpazleen · simpleform – form maker to chat apps with quiz, poll and multi lead notificationsOct 14, 2026
CVE-2026-104764
28Monitor
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
wpazleen · post export import with mediaOct 14, 2026
CVE-2026-104909
32Monitor
Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter
HighCVSS 8.1No exploitEPSS 1%
- pre-auth RCE
kitae-park · mang boardOct 14, 2026
CVE-2026-105106
36Monitor
Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
koha community · kohaOct 14, 2026
CVE-2026-105107
28Monitor
Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
koha community · kohaOct 14, 2026
CVE-2026-107631
28Monitor
Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
davidevalerio · record of consent extension for complianzOct 14, 2026
CVE-2026-107751
28Monitor
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
kitae-park · mang boardOct 14, 2026
CVE-2026-109901
34Monitor
WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
codepeople · cp multi view event calendarOct 14, 2026
CVE-2026-110284
30Monitor
LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
HighCVSS 7.5No exploitEPSS 0%
- RCE
lifterlms · lifterlms – wp lms for elearning, online courses, & quizzesOct 14, 2026
CVE-2026-92392
32Monitor
HTTP/2 upload Use-After-Free
HighCVSS 8.1Proof of conceptEPSS 1%
- Pre-auth
- Memory safety
curl · curlOct 14, 2026
CVE-2026-107428
28Monitor
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
videowhisper.com · paid videochat turnkey siteOct 14, 2026
CVE-2026-14851
36Monitor
Unauthorised disclosure of information on Copart’s online billing service
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Info leak
copart · copart’s online billing serviceOct 14, 2026
CVE-2026-73790
32Monitor
HPE NonStop iTP WebServer - Memory corruption vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
hewlett packard enterprise · hpe nonstop itp webserverOct 14, 2026
CVE-2026-73793
31Monitor
HPE NonStop Middleware - Secret key handling vulnerability
HighCVSS 7.9No exploitEPSS 0%
- Deserialization
hewlett packard enterprise · hpe nonstop middlewareOct 14, 2026
CVE-2026-86476
33Monitor
Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize
HighCVSS 8.4Proof of conceptEPSS 0%
- Deserialization
- Memory safety
red hat · red hat enterprise linux 10Oct 14, 2026
CVE-2026-88829
28Monitor
Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
red hat · red hat hardened imagesOct 14, 2026
CVE-2026-90954
31Monitor
Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
HighCVSS 7.8No exploitEPSS 0%
red hat · red hat hardened imagesOct 14, 2026
CVE-2026-101337
34Monitor
Stack overwrite from specially formatted base64 RDATA field
HighCVSS 8.7No exploitEPSS 0%
- Memory safety
nlnet labs · nsdOct 14, 2026
CVE-2026-101338
34Monitor
Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
HighCVSS 8.7No exploitEPSS 0%
- Memory safety
nlnet labs · nsdOct 14, 2026
CVE-2026-101339
34Monitor
Stack overwrite from a specially crafted and formatted HIP RR
HighCVSS 8.7No exploitEPSS 0%
- Memory safety
nlnet labs · nsdOct 14, 2026
CVE-2026-101341
34Monitor
Stack overwrite from specially formatted TXT-DATA RDATA field
HighCVSS 8.7No exploitEPSS 0%
- Memory safety
nlnet labs · nsdOct 14, 2026
CVE-2026-103358
30Monitor
WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
villatheme · email template customizer for woocommerceOct 14, 2026
CVE-2026-103904
34Monitor
Stored XSS Vulnerability in JTL-Shop
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
jtl-software gmbh · jtl-shopOct 14, 2026
CVE-2026-103905
34Monitor
Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
jtl-software gmbh · jtl-shopOct 14, 2026
CVE-2026-104795
35Monitor
Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
red hat · red hat openshift container platform 4Oct 14, 2026
CVE-2026-105067
34Monitor
WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
webnus · modern events calendar liteOct 14, 2026
CVE-2026-107431
30Monitor
WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
crocoblock · jetformbuilderOct 14, 2026
CVE-2026-108070
34Monitor
Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
tsplus · tsplus remote accessOct 14, 2026
CVE-2026-108071
34Monitor
Improper Multi-Factor Authentication Validation Allows Authentication Bypass
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
tsplus · tsplus remote accessOct 14, 2026
RUSTSEC-2026-0365
30Monitor
Remote DoS through unchecked `IdList` allocation in negentropy
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 14, 2026
CVE-2026-73798
32Monitor
HPE NonStop DNS 9.2.3 Non Secure Version
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
hewlett packard enterprise · hpe nonstop dns 9.2.3 non secure versionOct 14, 2026
CVE-2026-76655
30Monitor
HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Memory safety
- Denial of service
hewlett packard enterprise · hpe nonstop snmp trap multiplexerOct 14, 2026
CVE-2026-85298
29Monitor
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
HighCVSS 7.3No exploitEPSS 0%
- Broken access control (IDOR)
google cloud · application integrationOct 14, 2026
CVE-2026-105874
28Monitor
WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
brainstorm force · surecartOct 14, 2026
CVE-2026-106599
35Monitor
WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
brainstorm force · surecartOct 14, 2026
CVE-2026-107421
29Monitor
WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
videowhisper.com · broadcast live videoOct 14, 2026
CVE-2026-107424
39Monitor
WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
m a vinoth kumar · frontend dashboardOct 14, 2026
CVE-2026-107426
29Monitor
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
videowhisper.com · paid videochat turnkey siteOct 14, 2026
CVE-2026-107867
28Monitor
WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crocoblock · jetproducttablesOct 14, 2026
CVE-2026-108291
39Monitor
WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
itthinx · affiliatesOct 14, 2026
CVE-2026-16740
40Plan
Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
- Command injection
tr7 cyber defense inc. · tr7 aspOct 14, 2026
CVE-2026-16741
40Plan
OS Command in TR7 Cyber Defense's TR7 ASP
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
tr7 cyber defense inc. · tr7 aspOct 14, 2026
CVE-2026-82026
34Monitor
Radar < 1.12.2 Missing Authorization via /api/local-terminal
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
skyhook-io · radarOct 14, 2026
CVE-2026-97278
28Monitor
WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
wp syntex · polylangOct 14, 2026
CVE-2026-107870
28Monitor
WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crocoblock · jetengineOct 14, 2026