Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 47 of 88

  • CVE-2026-79839
    29Monitor

    HPE NonStop ODBC/MX Server - Memory corruption vulnerability

    HighCVSS 7.3No exploitEPSS 0%

    hewlett packard enterprise · hpe nonstop odbc/mx serverOct 15, 2026

  • CVE-2026-79840
    29Monitor

    HPE NonStop XABroker - Memory corruption vulnerability

    HighCVSS 7.3No exploitEPSS 0%

    hewlett packard enterprise · hpe nonstop xabrokerOct 15, 2026

  • CVE-2026-95179
    30Monitor

    An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animati

    HighCVSS 7.5No exploitEPSS 0%

    Oct 15, 2026

  • CVE-2026-9703
    28Monitor

    Viewer role can create, modify and delete Loki alerting rules

    HighCVSS 7.1No exploitEPSS 0%

    grafana · grafana enterpriseOct 15, 2026

  • CVE-2026-100349
    32Monitor

    kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

    HighCVSS 8.2No exploitEPSS 0%

    getkin · kin-openapiOct 15, 2026

  • CVE-2026-100351
    29Monitor

    kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

    HighCVSS 7.4No exploitEPSS 0%

    getkin · kin-openapiOct 15, 2026

  • CVE-2026-100352
    30Monitor

    kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

    HighCVSS 7.5No exploitEPSS 0%

    getkin · kin-openapiOct 15, 2026

  • CVE-2026-105474
    37Monitor

    A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary c

    CriticalCVSS 9.4No exploitEPSS 0%

    webpros · solusvm 2Oct 15, 2026

  • CVE-2026-109449
    34Monitor

    Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process

    HighCVSS 8.7No exploitEPSS 0%

    sensiolabs · symfonyOct 15, 2026

  • CVE-2026-110958
    37Monitor

    Wavlink WN530HG4B api.cgi heap-based overflow

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    wavlink · wn530hg4bOct 15, 2026

  • CVE-2026-111091
    31Monitor

    In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

    HighCVSS 7.8No exploitEPSS 0%

    jetbrains · junie cliOct 15, 2026

  • CVE-2026-111093
    30Monitor

    In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

    HighCVSS 7.5No exploitEPSS 0%

    jetbrains · dataloreOct 15, 2026

  • CVE-2026-111094
    39Monitor

    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was p

    CriticalCVSS 9.8No exploitEPSS 0%

    jetbrains · teamcityOct 15, 2026

  • CVE-2026-45449
    33Monitor

    Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    HighCVSS 8.3No exploitEPSS 0%

    unitronics · unitronics unistream pro/unilogicOct 15, 2026

  • CVE-2026-45450
    33Monitor

    Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

    HighCVSS 8.3No exploitEPSS 0%

    unitronics · unitronics unistream pro/unilogicOct 15, 2026

  • CVE-2026-45451
    33Monitor

    Unitronics - CWE-287: Improper Authentication

    HighCVSS 8.3No exploitEPSS 0%

    unitronics · unitronics unistream pro/unilogicOct 15, 2026

  • CVE-2026-45452
    33Monitor

    Unitronics - CWE-134 Use of Externally-Controlled format string

    HighCVSS 8.3No exploitEPSS 0%

    unitronics · unitronics unistream pro/unilogicOct 15, 2026

  • CVE-2026-53582
    28Monitor

    OPNsense: XPATH Injection can disclose any secret in config.xml

    HighCVSS 7.1Proof of conceptEPSS 0%

    opnsense · coreOct 15, 2026

  • CVE-2026-57155
    39Monitor

    OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    opnsense · coreOct 15, 2026

  • CVE-2026-58390
    32Monitor

    OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

    HighCVSS 8.0No exploitEPSS 0%

    opnsense · coreOct 15, 2026

  • CVE-2026-63442
    32Monitor

    OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

    HighCVSS 8.1No exploitEPSS 0%

    opnsense · coreOct 15, 2026

  • CVE-2026-71490
    28Monitor

    OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

    HighCVSS 7.1No exploitEPSS 0%

    opnsense · coreOct 15, 2026

  • CVE-2026-88753
    30Monitor

    A Regular-Expression Denial of Service (ReDoS) in the Markdown2.

    HighCVSS 7.5No exploitEPSS 0%

    Oct 15, 2026

  • CVE-2026-92982
    34Monitor

    Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

    HighCVSS 8.5No exploitEPSS 0%

    red hat · migration toolkit for applications 8Oct 15, 2026

  • CVE-2026-95155
    30Monitor

    FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial

    HighCVSS 7.5No exploitEPSS 0%

    Oct 15, 2026

  • CVE-2026-97394
    30Monitor

    kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

    HighCVSS 7.5No exploitEPSS 0%

    getkin · kin-openapiOct 15, 2026

  • CVE-2026-97665
    28Monitor

    Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload

    HighCVSS 7.1No exploitEPSS 0%

    sonatype · nexus repository 3Oct 15, 2026

  • CVE-2026-97712
    34Monitor

    Nexus Repository 3 - Privilege Escalation via Role Management

    HighCVSS 8.7No exploitEPSS 0%

    sonatype · nexus repository 3Oct 15, 2026

  • CVE-2026-100353
    30Monitor

    kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

    HighCVSS 7.5No exploitEPSS 0%

    getkin · kin-openapiOct 15, 2026

  • CVE-2026-100354
    30Monitor

    kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    HighCVSS 7.5No exploitEPSS 0%

    getkin · kin-openapiOct 15, 2026

  • CVE-2026-100409
    30Monitor

    OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

    HighCVSS 7.5No exploitEPSS 0%

    opennextjs · opennextjs-cloudflareOct 15, 2026

  • CVE-2026-105065
    28Monitor

    WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    8theme.com · xstoreOct 15, 2026

  • CVE-2026-110812
    37Monitor

    Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

    CriticalCVSS 9.4No exploitEPSS 0%

    aws · amazon neptune engineOct 15, 2026

  • CVE-2026-61611
    30Monitor

    Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks

    HighCVSS 7.5No exploitEPSS 0%

    lycheeorg · lycheeOct 15, 2026

  • CVE-2026-61838
    32Monitor

    Lychee: Album password bypass in ZIP downloads

    HighCVSS 8.2No exploitEPSS 0%

    lycheeorg · lycheeOct 15, 2026

  • CVE-2026-62679
    35Monitor

    Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

    HighCVSS 8.9No exploitEPSS 0%

    lycheeorg · lycheeOct 15, 2026

  • CVE-2026-77466
    33Monitor

    Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

    HighCVSS 8.3No exploitEPSS 0%

    lycheeorg · lycheeOct 15, 2026

  • CVE-2026-77467
    28Monitor

    Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path

    HighCVSS 7.1No exploitEPSS 0%

    lycheeorg · lycheeOct 15, 2026

  • CVE-2026-77470
    33Monitor

    Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

    HighCVSS 8.3No exploitEPSS 0%

    lycheeorg · lycheeOct 15, 2026

  • CVE-2026-78850
    20Monitor

    An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component.

    MediumCVSS 5.0Proof of conceptEPSS 0%

    Oct 15, 2026

  • CVE-2026-78851
    26Monitor

    Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExten

    MediumCVSS 6.5Proof of conceptEPSS 1%

    Oct 15, 2026

  • CVE-2026-85634
    35Monitor

    Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

    HighCVSS 8.8No exploitEPSS 0%

    red hat · red hat fuse 7Oct 15, 2026

  • CVE-2026-103936
    30Monitor

    libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

    HighCVSS 7.5No exploitEPSS 0%

    libp2p · js-libp2pOct 15, 2026

  • CVE-2026-111105
    28Monitor

    Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability

    HighCVSS 7.0No exploitEPSS 0%

    telegram · telegramOct 15, 2026

  • CVE-2026-55103
    34Monitor

    Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening

    HighCVSS 8.6No exploitEPSS 0%

    discourse · discourse-activity-pubOct 15, 2026

  • CVE-2026-55246
    31Monitor

    bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

    HighCVSS 7.8No exploitEPSS 0%

    tatsh · bincookieOct 15, 2026

  • CVE-2026-84731
    37Monitor

    Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS

    CriticalCVSS 9.3No exploitEPSS 1%

    nutanix · acropolis operating system (aos)Oct 15, 2026

  • CVE-2026-102946
    36Monitor

    joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

    CriticalCVSS 9.1No exploitEPSS 0%

    authlib · joserfcOct 15, 2026

  • CVE-2026-104150
    34Monitor

    AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

    HighCVSS 8.7No exploitEPSS 0%

    adonisjs · http-serverOct 15, 2026

  • CVE-2026-104827
    30Monitor

    react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

    HighCVSS 7.5No exploitEPSS 0%

    reactphp · httpOct 15, 2026

  • CVE-2026-104828
    28Monitor

    HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode

    HighCVSS 7.2No exploitEPSS 0%

    htmlunit · htmlunit-nekoOct 15, 2026

  • CVE-2026-108334
    29Monitor

    Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted http

    HighCVSS 7.4No exploitEPSS 0%

    red hat · red hat connectivity link 1Oct 15, 2026

  • CVE-2026-109383
    36Monitor

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    CriticalCVSS 9.1No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-109829
    36Monitor

    undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    CriticalCVSS 9.1No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-109841
    30Monitor

    undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

    HighCVSS 7.5No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-109869
    30Monitor

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    HighCVSS 7.5No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-109924
    30Monitor

    undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

    HighCVSS 7.5No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-109932
    30Monitor

    undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

    HighCVSS 7.5No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-110874
    30Monitor

    Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

    HighCVSS 7.5No exploitEPSS 0%

    dolibarr · dolibarrOct 15, 2026

  • CVE-2026-111160
    34Monitor

    LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization

    HighCVSS 8.7No exploitEPSS 0%

    modeltc · lightllmOct 15, 2026

  • CVE-2026-111170
    28Monitor

    kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name

    HighCVSS 7.1No exploitEPSS 0%

    kedro-org · kedro-datasetsOct 15, 2026

  • CVE-2026-111214
    37Monitor

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

    HighCVSS 8.6No exploitEPSS 10%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111215
    36Monitor

    Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

    HighCVSS 8.6No exploitEPSS 6%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111216
    35Monitor

    Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP

    HighCVSS 8.6No exploitEPSS 4%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111217
    36Monitor

    Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID

    HighCVSS 8.6No exploitEPSS 6%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111218
    37Monitor

    Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

    HighCVSS 8.6No exploitEPSS 8%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111219
    30Monitor

    Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

    HighCVSS 7.5No exploitEPSS 0%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111220
    34Monitor

    Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

    HighCVSS 8.6No exploitEPSS 0%

    netgate · pfsense ceOct 15, 2026

  • CVE-2026-111222
    30Monitor

    Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting

    HighCVSS 7.5No exploitEPSS 0%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111223
    34Monitor

    Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner

    HighCVSS 8.6No exploitEPSS 0%

    pfsense · pfsenseOct 15, 2026

  • CVE-2026-111224
    32Monitor

    Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

    HighCVSS 7.7No exploitEPSS 5%

    netgate · pfsense ceOct 15, 2026

  • CVE-2026-111226
    36Monitor

    Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php

    HighCVSS 8.6No exploitEPSS 6%

    netgate · pfsense ceOct 15, 2026

  • CVE-2026-111234
    32Monitor

    SimplePie through 1.9.0 Local File Read via file:// Redirect

    HighCVSS 8.2No exploitEPSS 0%

    simplepie · simplepieOct 15, 2026

  • CVE-2026-111235
    36Monitor

    OpenNMS REST authorization bypass via non-canonical HTTP method

    CriticalCVSS 9.1No exploitEPSS 0%

    the opennms group · meridianOct 15, 2026

  • CVE-2026-36436
    30Monitor

    An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface.

    HighCVSS 7.5Proof of conceptEPSS 0%

    Oct 15, 2026

  • CVE-2026-45165
    34Monitor

    Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API

    HighCVSS 8.6No exploitEPSS 0%

    palo alto networks · idira secrets manager (self-hosted)Oct 15, 2026

  • CVE-2026-47218
    37Monitor

    runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox

    CriticalCVSS 9.3No exploitEPSS 0%

    containerd · runwasiOct 15, 2026

  • CVE-2026-55239
    35Monitor

    Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

    HighCVSS 8.8No exploitEPSS 0%

    msgbyte · tianjiOct 15, 2026

  • CVE-2026-55240
    36Monitor

    Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates

    CriticalCVSS 9.1No exploitEPSS 0%

    msgbyte · tianjiOct 15, 2026

  • CVE-2026-55587
    32Monitor

    AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

    HighCVSS 8.1No exploitEPSS 0%

    aliasvault · aliasvaultOct 15, 2026

  • CVE-2026-55872
    34Monitor

    GYM One admin user list is vulnerable to stored cross-site scripting

    HighCVSS 8.7No exploitEPSS 0%

    mayerbalintdev · gym-oneOct 15, 2026

  • CVE-2026-57496
    38Monitor

    NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction

    CriticalCVSS 9.6No exploitEPSS 0%

    labs64 · netlicensing-mcpOct 15, 2026

  • CVE-2026-87018
    30Monitor

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    HighCVSS 7.5No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-87029
    30Monitor

    undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

    HighCVSS 7.5No exploitEPSS 0%

    nodejs · undiciOct 15, 2026

  • CVE-2026-97370
    30Monitor

    Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

    HighCVSS 7.5No exploitEPSS 0%

    junrar · junrarOct 15, 2026

  • CVE-2026-106700
    35Monitor

    ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhe

    HighCVSS 8.8No exploitEPSS 0%

    Oct 15, 2026

  • CVE-2026-106708
    35Monitor

    XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserCont

    HighCVSS 8.8No exploitEPSS 0%

    Oct 15, 2026

  • CVE-2026-102764
    91Now

    Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

    CriticalCVSS 9.3KEVWeaponizedEPSS 79%

    beyondtrust · remote supportOct 15, 2026

  • CVE-2026-105032
    36Monitor

    EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write

    CriticalCVSS 9.1No exploitEPSS 0%

    energizelab · fastapi ai inference serverOct 15, 2026

  • CVE-2026-105033
    35Monitor

    EnergizeLab AI Station Default Root Credentials with SSH Enabled

    HighCVSS 8.8No exploitEPSS 0%

    energizelab · ai station firmware (rk3562)Oct 15, 2026

  • CVE-2026-105034
    32Monitor

    EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

    HighCVSS 8.2No exploitEPSS 0%

    energizelab · nestjs auth serviceOct 15, 2026

  • CVE-2026-105035
    31Monitor

    EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key

    HighCVSS 7.8No exploitEPSS 0%

    energizelab · firmwareupdaterOct 15, 2026

  • CVE-2026-105036
    30Monitor

    EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

    HighCVSS 7.5No exploitEPSS 0%

    energizelab · robot firmware (mode 104000)Oct 15, 2026

  • CVE-2026-105037
    39Monitor

    EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

    CriticalCVSS 9.9No exploitEPSS 0%

    energizelab · station-middlewareOct 15, 2026

  • CVE-2026-105038
    39Monitor

    EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

    CriticalCVSS 9.8No exploitEPSS 0%

    energizelab · fastapi ai inference serverOct 15, 2026

  • CVE-2026-105039
    38Monitor

    EnergizeLab Station Middleware Admin APIs Missing Role Checks

    CriticalCVSS 9.6No exploitEPSS 0%

    energizelab · station-middlewareOct 15, 2026

  • CVE-2026-105040
    35Monitor

    EnergizeLab Eilik User-ID Mass Assignment Account Takeover

    HighCVSS 8.8No exploitEPSS 0%

    energizelab · nestjs auth serviceOct 15, 2026

  • CVE-2026-108426
    35Monitor

    Microsoft Office Word Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · 365 appsOct 15, 2026

  • CVE-2026-108427
    35Monitor

    Microsoft Office Word Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · 365 appsOct 15, 2026

  • CVE-2026-108428
    35Monitor

    Microsoft Office Word Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · 365 appsOct 15, 2026