By publication date

Exploited and new serious CVEs: October 2026

8,744 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 46 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
32Monitor	CVE-2026-101307No exploit	Remotely triggerable buffer overflow in tcp_rackfreebsd · freebsd · CWE-122 Pre-auth Memory safety	High8.2	—	0.3%	Oct 15, 2026
39Monitor	CVE-2026-109145No exploit	User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handlerunknown · user rights access manager · CWE-269 Pre-auth	Critical9.8	—	0.2%	Oct 15, 2026
34Monitor	CVE-2026-39993No exploit	Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameterqnap systems inc. · download station · CWE-23 RCE Path traversal	High8.7	—	0.3%	Oct 15, 2026
34Monitor	CVE-2026-41544No exploit	Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpointqnap systems inc. · qcalagent · CWE-22 RCE Path traversal	High8.7	—	0.3%	Oct 15, 2026
33Monitor	CVE-2026-58098No exploit	Heap out-of-bounds access in semop(2)freebsd · freebsd · CWE-787 Local privilege escalation Memory safety	High8.4	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-58099No exploit	Memory safety bugs in kqueue copy-on-fork implementationfreebsd · freebsd · CWE-362 Local privilege escalation Race condition	High7.0	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-58100No exploit	Memory safety bugs in kqueue copy-on-fork implementationfreebsd · freebsd · CWE-125 Local privilege escalation Memory safety	High7.0	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-74920No exploit	Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attributeunknown · document gallery · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 15, 2026
32Monitor	CVE-2026-79821No exploit	HPE NonStop SOAP 4.0 - Memory corruptionhewlett packard enterprise · hpe nonstop soap 4.0 · CWE-20 Pre-auth	High8.2	—	0.2%	Oct 15, 2026
28Monitor	CVE-2026-79822No exploit	HPE NonStop TNS/X Native Inspect - Execution flow vulnerabilityhewlett packard enterprise · hpe nonstop tns/x native inspect · CWE-122 Memory safety	High7.1	—	0.1%	Oct 15, 2026
35Monitor	CVE-2026-81534No exploit	Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameterthemehigh · email customizer for woocommerce (pro) · CWE-74 RCE	High8.8	—	0.4%	Oct 15, 2026
30Monitor	CVE-2026-96537No exploit	Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwriteunknown · tutor lms · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 15, 2026
28Monitor	CVE-2026-101309No exploit	Multiple vulnerabilities in bhyve device modelsfreebsd · freebsd · CWE-362 RCE Local privilege escalation Race condition	High7.0	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-101310No exploit	Multiple vulnerabilities in bhyve device modelsfreebsd · freebsd · CWE-126 RCE	High7.0	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-101311No exploit	Multiple vulnerabilities in bhyve device modelsfreebsd · freebsd · CWE-362 RCE Race condition	High7.0	—	0.1%	Oct 15, 2026
32Monitor	CVE-2026-102465No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-alleclipse · vert.x · CWE-770 Pre-auth Denial of service	High8.2	—	0.2%	Oct 15, 2026
34Monitor	CVE-2026-102467No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not defineclipse · vert.x · CWE-770 Pre-auth Denial of service	High8.7	—	0.2%	Oct 15, 2026
34Monitor	CVE-2026-102475No exploit	In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that reeclipse · vert.x · CWE-770 Pre-auth Denial of service	High8.7	—	0.2%	Oct 15, 2026
32Monitor	CVE-2023-32198No exploit	Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attackssuse · steve · CWE-295 Weak crypto	High8.0	—	0.3%	Oct 15, 2026
34Monitor	CVE-2024-22031No exploit	Rancher users who can create Projects can gain access to arbitrary projectssuse · rancher · CWE-863 Broken access control (IDOR)	High8.5	—	0.4%	Oct 15, 2026
37Monitor	CVE-2026-101287No exploit	Authentication bypass in Stela by Diaple Networkingdiaple · stela · CWE-565 Pre-auth Auth bypass	Critical9.3	—	0.3%	Oct 15, 2026
30Monitor	CVE-2026-101290No exploit	A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read dsick ag · sick_safetyscanners_base cpp driver · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 15, 2026
34Monitor	CVE-2026-102461No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an eclipse · vert.x · CWE-407 Pre-auth	High8.7	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-102462No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQLeclipse · vert.x · CWE-400 Pre-auth Denial of service	High8.2	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-102463No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-clienteclipse · vert.x · CWE-789 Pre-auth	High8.2	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-102464No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttCleclipse · vert.x · CWE-770 Pre-auth Denial of service	High8.2	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-102466No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-clienteclipse · vert.x · CWE-789 Pre-auth	High8.2	—	0.2%	Oct 15, 2026
36Monitor	CVE-2026-102469No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) coeclipse · vert.x · CWE-502 Pre-auth Deserialization	Critical9.2	—	0.4%	Oct 15, 2026
34Monitor	CVE-2026-102477No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable peeclipse · vert.x · CWE-409 Pre-auth	High8.7	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-103223No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-eclipse · vert.x · CWE-789 Pre-auth	High8.2	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-103224No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbouneclipse · vert.x · CWE-789 Pre-auth	High8.2	—	0.3%	Oct 15, 2026
30Monitor	CVE-2026-109855No exploit	undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakenodejs · undici · CWE-248 Pre-auth Denial of service	High7.5	—	0.2%	Oct 15, 2026
36Monitor	CVE-2026-16436No exploit	An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizmitsubishi electric corporation · genesis · CWE-640 Pre-auth Auth bypass	Critical9.2	—	0.3%	Oct 15, 2026
28Monitor	CVE-2026-16437No exploit	An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizmitsubishi electric corporation · genesis · CWE-640 Auth bypass	High7.1	—	0.1%	Oct 15, 2026
37Monitor	CVE-2026-16438No exploit	An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64mitsubishi electric corporation · genesis64 · CWE-266	Critical9.4	—	0.2%	Oct 15, 2026
35Monitor	CVE-2026-18661No exploit	In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rueclipse foundation · eclipse jetty · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.4%	Oct 15, 2026
32Monitor	CVE-2026-35088No exploit	Inadequate Encryption Strength in Slican telephone exchangesslican · ipx · CWE-326 Pre-auth Weak crypto	High8.2	—	0.1%	Oct 15, 2026
34Monitor	CVE-2026-63314No exploit	SQL Injection in WebCTIslican · ipx · CWE-89 SQL injection	High8.7	—	0.2%	Oct 15, 2026
32Monitor	CVE-2026-63315No exploit	Plaintext storage of a password in WebCTIslican · ipx · CWE-256 Pre-auth	High8.2	—	0.2%	Oct 15, 2026
32Monitor	CVE-2026-76184No exploit	In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the reclipse foundation · eclipse jetty · CWE-200 Pre-auth Info leak	High8.2	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-77711No exploit	When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Requiredeclipse foundation · eclipse jetty · CWE-200 Pre-auth Info leak	High8.2	—	0.4%	Oct 15, 2026
35Monitor	CVE-2026-18660No exploit	Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnameseclipse foundation · org.eclipse.jetty:jetty-server · CWE-178 Pre-auth	High8.8	—	0.3%	Oct 15, 2026
37Monitor	CVE-2026-19863No exploit	An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configureeclipse foundation · org.eclipse.jetty:jetty-ethereum · CWE-288 Pre-auth Auth bypass	Critical9.3	—	0.5%	Oct 15, 2026
28Monitor	CVE-2026-26243No exploit	Arbitrary Folder Deletion in Qsync Central 5.0.0.5qnap systems inc. · qsync central · CWE-22 Path traversal	High7.2	—	0.4%	Oct 15, 2026
28Monitor	CVE-2026-26244No exploit	SQLi#1 SQL Injection in class_videos.php _getFiltersqnap · video station · CWE-89 SQL injection	High7.1	—	0.3%	Oct 15, 2026
28Monitor	CVE-2026-26245No exploit	SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffsetqnap · video station · CWE-89 SQL injection	High7.1	—	0.3%	Oct 15, 2026
37Monitor	CVE-2026-34006No exploit	Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServerqnap systems inc. · smedio dtcp move · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.3%	Oct 15, 2026
34Monitor	CVE-2026-34008No exploit	Privilege Escalation World-writable crontab path monitored and executed by root-owned processqnap systems inc. · notes station 3 · CWE-732 Local privilege escalation	High8.5	—	0.0%	Oct 15, 2026
33Monitor	CVE-2026-34009No exploit	Container Escape Host user home directory mounted with write access into application containerqnap systems inc. · notes station 3 · CWE-653	High8.4	—	0.1%	Oct 15, 2026
33Monitor	CVE-2026-34014No exploit	ds-move-files.sh is writable and executed as rootqnap systems inc. · download station · CWE-732	High8.4	—	0.1%	Oct 15, 2026
34Monitor	CVE-2026-34015No exploit	Remote Code Execution in upload.php of Video Stationqnap · video station · CWE-22 RCE Path traversal	High8.7	—	0.3%	Oct 15, 2026
35Monitor	CVE-2026-39997No exploit	Unauthenticated Remote Input Injection in QNAP HD Station's remotepadqnap systems inc. · hybriddesk station · CWE-306 Pre-auth Auth bypass	High8.9	—	0.2%	Oct 15, 2026
34Monitor	CVE-2026-41545No exploit	WebSocket timelapse path traversal and command injectionqnap systems inc. · qumagie · CWE-23 RCE Path traversal Command injection	High8.6	—	0.4%	Oct 15, 2026
34Monitor	CVE-2026-44084No exploit	Access Code Forgery in Video Station leading to unauthorized media accessqnap · video station · CWE-639 Pre-auth Broken access control (IDOR)	High8.7	—	0.3%	Oct 15, 2026
37Monitor	CVE-2026-47786No exploit	Pre-Authentication Command Injectionqnap systems inc. · hybriddesk station · CWE-78 pre-auth RCE Command injection	Critical9.3	—	1.0%	Oct 15, 2026
37Monitor	CVE-2026-50612No exploit	Import Symlink Following Remote Code Execution Vulnerability in QuMagieqnap systems inc. · qumagie · CWE-61 RCE	Critical9.4	—	0.3%	Oct 15, 2026
37Monitor	CVE-2026-50619No exploit	Unauthenticated remote code execution vulnerabilityqnap systems inc. · qsirch · CWE-22 pre-auth RCE Path traversal	Critical9.3	—	0.4%	Oct 15, 2026
34Monitor	CVE-2026-53882No exploit	Path Traversal in Virtualization Station VM Importqnap systems inc. · virtualization station · CWE-59 Path traversal	High8.7	—	0.3%	Oct 15, 2026
32Monitor	CVE-2026-79824No exploit	HPE NonStop Python 3.x - Directory traversal vulnerabilityhewlett packard enterprise · hpe nonstop python 3.x · CWE-30 Pre-auth Path traversal	High8.0	—	0.3%	Oct 15, 2026
28Monitor	CVE-2026-79825No exploit	HPE NonStop NDSREST - Heap buffer overflow vulnerabilityhewlett packard enterprise · hpe nonstop ndsrest · CWE-122 Memory safety	High7.1	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-79826No exploit	HPE NonStop OCAX - Heap buffer overflow vulnerabilityhewlett packard enterprise · hpe nonstop ocax · CWE-122 Memory safety	High7.1	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-79827No exploit	HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerabilityhewlett packard enterprise · hpe nonstop inspect subsystem · CWE-122 Memory safety	High7.1	—	0.1%	Oct 15, 2026
28Monitor	CVE-2026-79828No exploit	HPE NonStop Debug Utilities - Heap buffer overflow vulnerabilityhewlett packard enterprise · hpe nonstop debug utilities · CWE-122 Memory safety	High7.1	—	0.1%	Oct 15, 2026
32Monitor	CVE-2026-79829No exploit	HPE NonStop HTTP WEBSERVER - Memory corruption vulnerabilityhewlett packard enterprise · hpe nonstop http webserver · CWE-20 Pre-auth	High8.2	—	0.2%	Oct 15, 2026
28Monitor	CVE-2026-108491No exploit	WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerabilityeverest forms · everest forms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 15, 2026
37Monitor	CVE-2026-108497No exploit	WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerabilitytms · amelia · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 15, 2026
28Monitor	CVE-2026-108498No exploit	WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerabilitybannersky · bsk pdf manager · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 15, 2026
39Monitor	CVE-2026-109694No exploit	WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerabilitywp manageninja llc · fluent crm · CWE-266 Pre-auth	Critical9.8	—	0.2%	Oct 15, 2026
30Monitor	CVE-2026-109695No exploit	WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerabilitywpmanageninja · fluentcart · CWE-201 Pre-auth	High7.5	—	0.2%	Oct 15, 2026
30Monitor	CVE-2026-79832No exploit	HPE NonStop SQL/MX Executor - Buffer overflow vulnerabilityhewlett packard enterprise · hpe nonstop sql/mx executor · CWE-121 Memory safety	High7.6	—	0.1%	Oct 15, 2026
30Monitor	CVE-2026-79833No exploit	HPE NonStop ANSI SQLUTIL - Denial of Service vulnerabilityhewlett packard enterprise · hpe nonstop ansi sqlutil · CWE-248 Pre-auth Denial of service	High7.5	—	0.2%	Oct 15, 2026
29Monitor	CVE-2026-79834No exploit	HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerabilityhewlett packard enterprise · hpe nonstop sql/mx sqlcat · CWE-20 RCE	High7.4	—	0.5%	Oct 15, 2026
33Monitor	CVE-2026-104025No exploit	Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry namepeazip · peazip · CWE-22 Path traversal	High8.4	—	0.1%	Oct 15, 2026
30Monitor	CVE-2026-107416No exploit	WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerabilitywebba plugins · webba booking · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 15, 2026
28Monitor	CVE-2026-109685No exploit	WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerabilitylink whisper inc · link whisper free · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 15, 2026
39Monitor	CVE-2026-109686No exploit	WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerabilitylink whisper inc · link whisper free · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 15, 2026
37Monitor	CVE-2026-109688No exploit	WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerabilitylink whisper inc · link whisper free · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 15, 2026
28Monitor	CVE-2026-109692No exploit	WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerabilitythemegrill · user registration · CWE-862 Broken access control (IDOR)	High7.1	—	0.1%	Oct 15, 2026
35Monitor	CVE-2026-109693No exploit	WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerabilitywp manageninja llc · fluent crm · CWE-266	High8.8	—	0.2%	Oct 15, 2026
37Monitor	CVE-2026-109698No exploit	WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerabilitykitae park · mang board wp · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 15, 2026
28Monitor	CVE-2026-109702No exploit	WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerabilitymaxfoundry · social share buttons · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 15, 2026
39Monitor	CVE-2026-109892No exploit	WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerabilityshabti kaplan · frontend admin by dynamiapps · CWE-266 Pre-auth	Critical9.8	—	0.2%	Oct 15, 2026
30Monitor	CVE-2026-110723No exploit	In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from teclipse foundation · eclipse connected services platform · CWE-290 Pre-auth Auth bypass Denial of service	High7.5	—	0.3%	Oct 15, 2026
30Monitor	CVE-2026-110724No exploit	In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from teclipse foundation · eclipse connected services platform · CWE-269 Pre-auth	High7.5	—	0.2%	Oct 15, 2026
29Monitor	CVE-2026-79837No exploit	HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerabilityhewlett packard enterprise · hpe nonstop sql/mx udr server · CWE-20	High7.3	—	0.0%	Oct 15, 2026
32Monitor	CVE-2026-88794No exploit	XML External Entity injection in Sparx Enterprise Architectsparx systems · enterprise architect · CWE-611 Pre-auth XXE	High8.2	—	0.3%	Oct 15, 2026
39Monitor	CVE-2026-98432Proof of concept	ipv4: free inet_opt and ireq_opt after an RCU grace periodlinux · linux Pre-auth	Critical9.8	—	0.7%	Oct 15, 2026
37Monitor	CVE-2026-99999Proof of concept	ipv4: validate checksum_start before completing checksumlinux · linux · CWE-20	Critical9.3	—	0.7%	Oct 15, 2026
30Monitor	CVE-2026-93649No exploit	In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (eclipse foundation · adoptium temurin · CWE-494 Pre-auth	High7.5	—	0.1%	Oct 15, 2026
29Monitor	CVE-2026-103508No exploit	Path traversal via logging configuration in P4Searchperforce · p4 (helix core) · CWE-23 Path traversal	High7.3	—	0.4%	Oct 15, 2026
34Monitor	CVE-2026-103509No exploit	Credential Disclosure in P4 Search Configuration APIperforce · p4 (helix core) · CWE-1220	High8.5	—	0.2%	Oct 15, 2026
39Monitor	CVE-2026-104586Proof of concept	AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.CWE-94 pre-auth RCE Command injection	Critical9.8	—	1.5%	Oct 15, 2026
34Monitor	CVE-2026-108082No exploit	Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Headersensiolabs · symfony · CWE-1333 Pre-auth Denial of service	High8.7	—	0.4%	Oct 15, 2026
30Monitor	CVE-2026-108116No exploit	MDX and SOAP Injection in Kendo UI for jQueryprogress · kendo ui · CWE-74 Pre-auth	High7.5	—	0.2%	Oct 15, 2026
34Monitor	CVE-2026-109413No exploit	Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Processsensiolabs · symfony · CWE-674 Pre-auth Denial of service	High8.7	—	0.3%	Oct 15, 2026
31Monitor	CVE-2026-110746No exploit	A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through totalsecurity · totalav · CWE-22 RCE Path traversal Local privilege escalation	High7.8	—	0.2%	Oct 15, 2026
63This week	CVE-2026-110936Weaponized	A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).siemens · software center · CWE-427 RCE Local privilege escalation	High8.4	KEV	0.9%	Oct 15, 2026
38Monitor	CVE-2026-110957No exploit	Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injectionwavlink · wl-wn530be2-a · CWE-77 pre-auth RCE Command injection	Critical9.3	—	3.0%	Oct 15, 2026
36Monitor	CVE-2026-47168No exploit	EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export paramsespocrm · espocrm · CWE-502 RCE Deserialization	Critical9.1	—	0.4%	Oct 15, 2026
30Monitor	CVE-2026-53574No exploit	EspoCRM: Blind SQL injection via streamAttachments where-clause complex expressionespocrm · espocrm · CWE-89 SQL injection	High7.6	—	0.2%	Oct 15, 2026

CVE-2026-101307
32Monitor
Remotely triggerable buffer overflow in tcp_rack
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
freebsd · freebsdOct 15, 2026
CVE-2026-109145
39Monitor
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · user rights access managerOct 15, 2026
CVE-2026-39993
34Monitor
Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
qnap systems inc. · download stationOct 15, 2026
CVE-2026-41544
34Monitor
Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
qnap systems inc. · qcalagentOct 15, 2026
CVE-2026-58098
33Monitor
Heap out-of-bounds access in semop(2)
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
- Memory safety
freebsd · freebsdOct 15, 2026
CVE-2026-58099
28Monitor
Memory safety bugs in kqueue copy-on-fork implementation
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Race condition
freebsd · freebsdOct 15, 2026
CVE-2026-58100
28Monitor
Memory safety bugs in kqueue copy-on-fork implementation
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Memory safety
freebsd · freebsdOct 15, 2026
CVE-2026-74920
28Monitor
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · document galleryOct 15, 2026
CVE-2026-79821
32Monitor
HPE NonStop SOAP 4.0 - Memory corruption
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
hewlett packard enterprise · hpe nonstop soap 4.0Oct 15, 2026
CVE-2026-79822
28Monitor
HPE NonStop TNS/X Native Inspect - Execution flow vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
hewlett packard enterprise · hpe nonstop tns/x native inspectOct 15, 2026
CVE-2026-81534
35Monitor
Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
HighCVSS 8.8No exploitEPSS 0%
- RCE
themehigh · email customizer for woocommerce (pro)Oct 15, 2026
CVE-2026-96537
30Monitor
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · tutor lmsOct 15, 2026
CVE-2026-101309
28Monitor
Multiple vulnerabilities in bhyve device models
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Local privilege escalation
- Race condition
freebsd · freebsdOct 15, 2026
CVE-2026-101310
28Monitor
Multiple vulnerabilities in bhyve device models
HighCVSS 7.0No exploitEPSS 0%
- RCE
freebsd · freebsdOct 15, 2026
CVE-2026-101311
28Monitor
Multiple vulnerabilities in bhyve device models
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Race condition
freebsd · freebsdOct 15, 2026
CVE-2026-102465
32Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-all
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse · vert.xOct 15, 2026
CVE-2026-102467
34Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not defin
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse · vert.xOct 15, 2026
CVE-2026-102475
34Monitor
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that re
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse · vert.xOct 15, 2026
CVE-2023-32198
32Monitor
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks
HighCVSS 8.0No exploitEPSS 0%
- Weak crypto
suse · steveOct 15, 2026
CVE-2024-22031
34Monitor
Rancher users who can create Projects can gain access to arbitrary projects
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
suse · rancherOct 15, 2026
CVE-2026-101287
37Monitor
Authentication bypass in Stela by Diaple Networking
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
diaple · stelaOct 15, 2026
CVE-2026-101290
30Monitor
A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read d
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sick ag · sick_safetyscanners_base cpp driverOct 15, 2026
CVE-2026-102461
34Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
eclipse · vert.xOct 15, 2026
CVE-2026-102462
32Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse · vert.xOct 15, 2026
CVE-2026-102463
32Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
eclipse · vert.xOct 15, 2026
CVE-2026-102464
32Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttCl
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse · vert.xOct 15, 2026
CVE-2026-102466
32Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
eclipse · vert.xOct 15, 2026
CVE-2026-102469
36Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) co
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Deserialization
eclipse · vert.xOct 15, 2026
CVE-2026-102477
34Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable pe
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
eclipse · vert.xOct 15, 2026
CVE-2026-103223
32Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
eclipse · vert.xOct 15, 2026
CVE-2026-103224
32Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inboun
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
eclipse · vert.xOct 15, 2026
CVE-2026-109855
30Monitor
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
nodejs · undiciOct 15, 2026
CVE-2026-16436
36Monitor
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
mitsubishi electric corporation · genesisOct 15, 2026
CVE-2026-16437
28Monitor
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
mitsubishi electric corporation · genesisOct 15, 2026
CVE-2026-16438
37Monitor
An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
CriticalCVSS 9.4No exploitEPSS 0%
mitsubishi electric corporation · genesis64Oct 15, 2026
CVE-2026-18661
35Monitor
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern ru
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
eclipse foundation · eclipse jettyOct 15, 2026
CVE-2026-35088
32Monitor
Inadequate Encryption Strength in Slican telephone exchanges
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
slican · ipxOct 15, 2026
CVE-2026-63314
34Monitor
SQL Injection in WebCTI
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
slican · ipxOct 15, 2026
CVE-2026-63315
32Monitor
Plaintext storage of a password in WebCTI
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
slican · ipxOct 15, 2026
CVE-2026-76184
32Monitor
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the r
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
eclipse foundation · eclipse jettyOct 15, 2026
CVE-2026-77711
32Monitor
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
eclipse foundation · eclipse jettyOct 15, 2026
CVE-2026-18660
35Monitor
Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
eclipse foundation · org.eclipse.jetty:jetty-serverOct 15, 2026
CVE-2026-19863
37Monitor
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configure
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
eclipse foundation · org.eclipse.jetty:jetty-ethereumOct 15, 2026
CVE-2026-26243
28Monitor
Arbitrary Folder Deletion in Qsync Central 5.0.0.5
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
qnap systems inc. · qsync centralOct 15, 2026
CVE-2026-26244
28Monitor
SQLi#1 SQL Injection in class_videos.php _getFilters
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
qnap · video stationOct 15, 2026
CVE-2026-26245
28Monitor
SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
qnap · video stationOct 15, 2026
CVE-2026-34006
37Monitor
Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
qnap systems inc. · smedio dtcp moveOct 15, 2026
CVE-2026-34008
34Monitor
**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
qnap systems inc. · notes station 3Oct 15, 2026
CVE-2026-34009
33Monitor
**Container Escape** Host user home directory mounted with write access into application container
HighCVSS 8.4No exploitEPSS 0%
qnap systems inc. · notes station 3Oct 15, 2026
CVE-2026-34014
33Monitor
ds-move-files.sh is writable and executed as root
HighCVSS 8.4No exploitEPSS 0%
qnap systems inc. · download stationOct 15, 2026
CVE-2026-34015
34Monitor
Remote Code Execution in upload.php of Video Station
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
qnap · video stationOct 15, 2026
CVE-2026-39997
35Monitor
Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Auth bypass
qnap systems inc. · hybriddesk stationOct 15, 2026
CVE-2026-41545
34Monitor
WebSocket timelapse path traversal and command injection
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Path traversal
- Command injection
qnap systems inc. · qumagieOct 15, 2026
CVE-2026-44084
34Monitor
Access Code Forgery in Video Station leading to unauthorized media access
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
qnap · video stationOct 15, 2026
CVE-2026-47786
37Monitor
Pre-Authentication Command Injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
qnap systems inc. · hybriddesk stationOct 15, 2026
CVE-2026-50612
37Monitor
Import Symlink Following Remote Code Execution Vulnerability in QuMagie
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
qnap systems inc. · qumagieOct 15, 2026
CVE-2026-50619
37Monitor
Unauthenticated remote code execution vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Path traversal
qnap systems inc. · qsirchOct 15, 2026
CVE-2026-53882
34Monitor
Path Traversal in Virtualization Station VM Import
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
qnap systems inc. · virtualization stationOct 15, 2026
CVE-2026-79824
32Monitor
HPE NonStop Python 3.x - Directory traversal vulnerability
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
- Path traversal
hewlett packard enterprise · hpe nonstop python 3.xOct 15, 2026
CVE-2026-79825
28Monitor
HPE NonStop NDSREST - Heap buffer overflow vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
hewlett packard enterprise · hpe nonstop ndsrestOct 15, 2026
CVE-2026-79826
28Monitor
HPE NonStop OCAX - Heap buffer overflow vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
hewlett packard enterprise · hpe nonstop ocaxOct 15, 2026
CVE-2026-79827
28Monitor
HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
hewlett packard enterprise · hpe nonstop inspect subsystemOct 15, 2026
CVE-2026-79828
28Monitor
HPE NonStop Debug Utilities - Heap buffer overflow vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
hewlett packard enterprise · hpe nonstop debug utilitiesOct 15, 2026
CVE-2026-79829
32Monitor
HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
hewlett packard enterprise · hpe nonstop http webserverOct 15, 2026
CVE-2026-108491
28Monitor
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
everest forms · everest formsOct 15, 2026
CVE-2026-108497
37Monitor
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
tms · ameliaOct 15, 2026
CVE-2026-108498
28Monitor
WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bannersky · bsk pdf managerOct 15, 2026
CVE-2026-109694
39Monitor
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
wp manageninja llc · fluent crmOct 15, 2026
CVE-2026-109695
30Monitor
WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
wpmanageninja · fluentcartOct 15, 2026
CVE-2026-79832
30Monitor
HPE NonStop SQL/MX Executor - Buffer overflow vulnerability
HighCVSS 7.6No exploitEPSS 0%
- Memory safety
hewlett packard enterprise · hpe nonstop sql/mx executorOct 15, 2026
CVE-2026-79833
30Monitor
HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
hewlett packard enterprise · hpe nonstop ansi sqlutilOct 15, 2026
CVE-2026-79834
29Monitor
HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability
HighCVSS 7.4No exploitEPSS 0%
- RCE
hewlett packard enterprise · hpe nonstop sql/mx sqlcatOct 15, 2026
CVE-2026-104025
33Monitor
Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name
HighCVSS 8.4No exploitEPSS 0%
- Path traversal
peazip · peazipOct 15, 2026
CVE-2026-107416
30Monitor
WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
webba plugins · webba bookingOct 15, 2026
CVE-2026-109685
28Monitor
WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
link whisper inc · link whisper freeOct 15, 2026
CVE-2026-109686
39Monitor
WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
link whisper inc · link whisper freeOct 15, 2026
CVE-2026-109688
37Monitor
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
link whisper inc · link whisper freeOct 15, 2026
CVE-2026-109692
28Monitor
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
themegrill · user registrationOct 15, 2026
CVE-2026-109693
35Monitor
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
wp manageninja llc · fluent crmOct 15, 2026
CVE-2026-109698
37Monitor
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
kitae park · mang board wpOct 15, 2026
CVE-2026-109702
28Monitor
WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
maxfoundry · social share buttonsOct 15, 2026
CVE-2026-109892
39Monitor
WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
shabti kaplan · frontend admin by dynamiappsOct 15, 2026
CVE-2026-110723
30Monitor
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from t
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
eclipse foundation · eclipse connected services platformOct 15, 2026
CVE-2026-110724
30Monitor
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from t
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse connected services platformOct 15, 2026
CVE-2026-79837
29Monitor
HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerability
HighCVSS 7.3No exploitEPSS 0%
hewlett packard enterprise · hpe nonstop sql/mx udr serverOct 15, 2026
CVE-2026-88794
32Monitor
XML External Entity injection in Sparx Enterprise Architect
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- XXE
sparx systems · enterprise architectOct 15, 2026
CVE-2026-98432
39Monitor
ipv4: free inet_opt and ireq_opt after an RCU grace period
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
linux · linuxOct 15, 2026
CVE-2026-99999
37Monitor
ipv4: validate checksum_start before completing checksum
CriticalCVSS 9.3Proof of conceptEPSS 0%
linux · linuxOct 15, 2026
CVE-2026-93649
30Monitor
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
eclipse foundation · adoptium temurinOct 15, 2026
CVE-2026-103508
29Monitor
Path traversal via logging configuration in P4Search
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
perforce · p4 (helix core)Oct 15, 2026
CVE-2026-103509
34Monitor
Credential Disclosure in P4 Search Configuration API
HighCVSS 8.5No exploitEPSS 0%
perforce · p4 (helix core)Oct 15, 2026
CVE-2026-104586
39Monitor
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
Oct 15, 2026
CVE-2026-108082
34Monitor
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
sensiolabs · symfonyOct 15, 2026
CVE-2026-108116
30Monitor
MDX and SOAP Injection in Kendo UI for jQuery
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
progress · kendo uiOct 15, 2026
CVE-2026-109413
34Monitor
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
sensiolabs · symfonyOct 15, 2026
CVE-2026-110746
31Monitor
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Path traversal
- Local privilege escalation
totalsecurity · totalavOct 15, 2026
CVE-2026-110936
63This week
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8).
HighCVSS 8.4KEVWeaponizedEPSS 0%
- RCE
- Local privilege escalation
siemens · software centerOct 15, 2026
CVE-2026-110957
38Monitor
Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection
CriticalCVSS 9.3No exploitEPSS 3%
- pre-auth RCE
- Command injection
wavlink · wl-wn530be2-aOct 15, 2026
CVE-2026-47168
36Monitor
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Deserialization
espocrm · espocrmOct 15, 2026
CVE-2026-53574
30Monitor
EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
espocrm · espocrmOct 15, 2026