By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 51 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
23Monitor	CVE-2026-104246Proof of concept	Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachmentsunknown · contact form 7 signature addon · CWE-22 Pre-auth Path traversal	Medium5.9	—	0.2%	Oct 17, 2026
28Monitor	CVE-2026-110384No exploit	WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerabilityheateor support · fancy comments wordpress · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 17, 2026
28Monitor	CVE-2026-100316No exploit	European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Headerdavidanderson · european vat compliance assistant for woocommerce · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 17, 2026
28Monitor	CVE-2026-111110No exploit	Payment forms, Buy now buttons, and Invoicing System \| GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameterstiofansisland · payment forms, buy now buttons, and invoicing system \| getpaid · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 17, 2026
30Monitor	CVE-2026-110889No exploit	WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerabilitygantry · gantry 5 framework · CWE-209 Pre-auth Info leak	High7.5	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-109701No exploit	WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerabilitypaycomet · paycomet for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 17, 2026
33Monitor	CVE-2026-111880No exploit	FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offsetfreerdp · freerdp · CWE-787 Pre-auth Memory safety	High8.3	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111881No exploit	FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboardfreerdp · freerdp · CWE-191 Pre-auth Memory safety	High7.2	—	0.2%	Oct 17, 2026
34Monitor	CVE-2026-111882No exploit	phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacksthorsten · phpmyfaq · CWE-287 Pre-auth Auth bypass	High8.6	—	0.3%	Oct 17, 2026
34Monitor	CVE-2026-111884No exploit	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeoverthorsten · phpmyfaq · CWE-308 CSRF	High8.7	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111885No exploit	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup APIthorsten · phpmyfaq · CWE-1220	High7.0	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111886No exploit	phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpointthorsten · phpmyfaq · CWE-307 Pre-auth CSRF	High7.1	—	0.2%	Oct 17, 2026
28Monitor	CVE-2026-111890No exploit	phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRightsthorsten · phpmyfaq · CWE-269	High7.0	—	0.2%	Oct 17, 2026
28Monitor	CVE-2026-111891No exploit	phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions APIthorsten · phpmyfaq · CWE-269	High7.0	—	0.2%	Oct 17, 2026
34Monitor	CVE-2026-111893No exploit	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions APIthorsten · phpmyfaq · CWE-269	High8.5	—	0.3%	Oct 17, 2026
30Monitor	CVE-2026-111895No exploit	phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_usernamethorsten · phpmyfaq · CWE-287 Auth bypass	High7.6	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111897No exploit	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpointsthorsten · phpmyfaq · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Oct 17, 2026
30Monitor	CVE-2026-111898No exploit	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linkingthorsten · phpmyfaq · CWE-287 Auth bypass	High7.7	—	0.4%	Oct 17, 2026
34Monitor	CVE-2026-111901No exploit	phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Paginationthorsten · phpmyfaq · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Oct 17, 2026
28Monitor	CVE-2026-111905No exploit	phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/datathorsten · phpmyfaq · CWE-639 Broken access control (IDOR)	High7.0	—	0.4%	Oct 17, 2026
28Monitor	CVE-2026-111906No exploit	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operationsthorsten · phpmyfaq · CWE-352 Pre-auth CSRF	High7.1	—	0.1%	Oct 17, 2026
28Monitor	CVE-2026-111907No exploit	phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-databasethorsten · phpmyfaq · CWE-352 Pre-auth CSRF	High7.1	—	0.1%	Oct 17, 2026
34Monitor	CVE-2026-111908No exploit	phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST APIthorsten · phpmyfaq · CWE-639 Broken access control (IDOR)	High8.7	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111909No exploit	phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser APIthorsten · phpmyfaq · CWE-269	High7.2	—	0.2%	Oct 17, 2026
28Monitor	CVE-2026-111910No exploit	phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloadsthorsten · phpmyfaq · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 17, 2026
37Monitor	CVE-2026-111911No exploit	phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injectionthorsten · phpmyfaq · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.5%	Oct 17, 2026
28Monitor	CVE-2026-111912No exploit	Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Updateadmidio · admidio · CWE-639 Broken access control (IDOR) CSRF	High7.1	—	0.2%	Oct 17, 2026
28Monitor	CVE-2026-111914No exploit	Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.phpadmidio · admidio · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111917No exploit	Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocationgo-vikunja · vikunja · CWE-613	High7.1	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111919No exploit	Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooksgo-vikunja · vikunja · CWE-613	High7.1	—	0.3%	Oct 17, 2026
28Monitor	CVE-2026-111922No exploit	Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Originsgo-vikunja · vikunja · CWE-942	High7.2	—	0.1%	Oct 17, 2026
34Monitor	CVE-2026-111923No exploit	Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsingfleetdm · fleet · CWE-674 Pre-auth Denial of service	High8.7	—	0.3%	Oct 17, 2026
34Monitor	CVE-2026-111924No exploit	Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompressionfleetdm · fleet · CWE-409 Pre-auth	High8.7	—	0.3%	Oct 17, 2026
34Monitor	CVE-2026-111927No exploit	Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Matchcoder · coder · CWE-522 Info leak	High8.7	—	0.2%	Oct 17, 2026
28Monitor	CVE-2026-110031No exploit	Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Keyunknown · salon booking system · CWE-269	High7.2	—	0.2%	Oct 18, 2026
28Monitor	CVE-2026-110981No exploit	WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameterunknown · wp photo album plus · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 18, 2026
30Monitor	CVE-2026-96534No exploit	Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_exportunknown · modern events calendar lite · CWE-89 SQL injection	High7.7	—	0.2%	Oct 18, 2026
35Monitor	CVE-2026-107436No exploit	WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerabilitywp chill · strong testimonials · CWE-502 Deserialization	High8.8	—	0.4%	Oct 18, 2026
28Monitor	CVE-2026-108485No exploit	WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerabilitythemegrill · estore · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 18, 2026
37Monitor	CVE-2026-109894No exploit	WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerabilityarraytics · booktics · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 18, 2026
28Monitor	CVE-2026-109895No exploit	WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerabilityarraytics · booktics · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 18, 2026
39Monitor	CVE-2026-110372Proof of concept	WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerabilitybrainstorm force · ottokit · CWE-266 Pre-auth	Critical9.8	—	1.3%	Oct 18, 2026
32Monitor	CVE-2026-110373No exploit	WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerabilityhamid alinia · login with phone number · CWE-266 Pre-auth	High8.1	—	0.3%	Oct 18, 2026
28Monitor	CVE-2026-110382No exploit	WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerabilitynsquared · simply schedule appointments · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 18, 2026
30Monitor	CVE-2026-110383No exploit	WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerabilitywp e-signature · electronic signature add-on for fluent forms · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 18, 2026
39Monitor	CVE-2026-110886No exploit	WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerabilityquantumcloud · conversational forms for chatbot · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 18, 2026
34Monitor	CVE-2026-110895No exploit	WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerabilitydevitems · support genix · CWE-89 SQL injection	High8.5	—	0.2%	Oct 18, 2026
28Monitor	CVE-2026-110897No exploit	WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityideabox creations · powerpack lite for beaver builder · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 18, 2026
30Monitor	RUSTSEC-2026-0414No exploit	Exponential event growth with `ENABLE_WIKILINKS` Pre-auth Denial of service	High7.5	—	—	Oct 18, 2026
37Monitor	CVE-2026-111998No exploit	Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gatewayvanus-labs · vanus · CWE-1392 Pre-auth Hard-coded credentials	Critical9.3	—	0.6%	Oct 18, 2026
34Monitor	CVE-2026-111999No exploit	Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receivervanus-labs · vanus · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Oct 18, 2026
28Monitor	CVE-2026-112000No exploit	Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCsvanus-labs · vanus · CWE-862 Broken access control (IDOR)	High7.2	—	0.2%	Oct 18, 2026
34Monitor	CVE-2026-112001No exploit	ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilitiesprojectsend · projectsend · CWE-863 Broken access control (IDOR)	High8.6	—	0.6%	Oct 18, 2026
30Monitor	CVE-2026-112002No exploit	ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/passwordprojectsend · projectsend · CWE-620	High7.6	—	0.2%	Oct 18, 2026
36Monitor	CVE-2026-112005No exploit	WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editorclidey · whodb · CWE-22 Pre-auth Path traversal	Critical9.2	—	0.6%	Oct 18, 2026
33Monitor	CVE-2026-112006No exploit	OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validationopentelemetry · opentelemetry-exporter-otlp-proto-http · CWE-295 Pre-auth Weak crypto	High8.3	—	0.2%	Oct 18, 2026
30Monitor	CVE-2026-112015No exploit	Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwdomnigent-ai · omnigent · CWE-22 Path traversal	High7.7	—	0.4%	Oct 18, 2026
28Monitor	CVE-2026-112017No exploit	JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypassjeecgboot · jeecgboot · CWE-89 SQL injection	High7.1	—	0.2%	Oct 18, 2026
29Monitor	CVE-2026-112018No exploit	cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()jkuhlmann · cgltf · CWE-787 Memory safety	High7.3	—	0.1%	Oct 18, 2026
34Monitor	CVE-2026-112021No exploit	snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()grunfink · snac2 · CWE-122 Pre-auth Memory safety	High8.7	—	0.6%	Oct 18, 2026
33Monitor	CVE-2026-78497No exploit	JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string evalCWE-95 RCE	High8.4	—	0.1%	Oct 18, 2026
33Monitor	CVE-2026-112051No exploit	Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registrationxorbitsai · inference · CWE-22 Pre-auth Path traversal	High8.3	—	0.3%	Oct 18, 2026
31Monitor	CVE-2026-98436No exploit	accel/amdxdna: Disable device buffer exportinglinux · linux	High7.8	—	0.1%	Oct 18, 2026
28Monitor	CVE-2026-98440No exploit	KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destructionlinux · linux	High7.0	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98441No exploit	net/sched: act_ct: avoid modifying shared unconfirmed ct entrylinux · linux	High7.8	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98442No exploit	net/sched: act_ct: fix helper UAF due to extensions realloclinux · linux	High7.8	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98443No exploit	xfs: fix cursor and pointer handling when recovering iunlink bucketslinux · linux	High7.8	—	0.1%	Oct 18, 2026
35Monitor	CVE-2026-98451No exploit	smb: client: use finish_no_open() for non-regular inodeslinux · linux Pre-auth	High8.8	—	0.3%	Oct 18, 2026
32Monitor	CVE-2026-98454No exploit	smb: client: fix create context out-of-bounds readslinux · linux Pre-auth	High8.1	—	0.3%	Oct 18, 2026
28Monitor	CVE-2026-98456No exploit	Bluetooth: mgmt: fix race in read_unconf_index_list()linux · linux	High7.0	—	0.1%	Oct 18, 2026
37Monitor	CVE-2026-98464No exploit	RISC-V: KVM: Synchronize hrtimer callback during teardownlinux · linux	Critical9.3	—	0.1%	Oct 18, 2026
28Monitor	CVE-2026-98465No exploit	RISC-V: KVM: Serialize IMSIC attributes with vCPU migrationlinux · linux	High7.0	—	0.1%	Oct 18, 2026
32Monitor	CVE-2026-98466No exploit	KVM: arm64: Transfer the hyp stack pages out of the host stage-2linux · linux	High8.2	—	0.1%	Oct 18, 2026
28Monitor	CVE-2026-98469No exploit	KVM: arm64: Fix AArch32 DBGBXVR<n> handlinglinux · linux Denial of service	High7.1	—	0.1%	Oct 18, 2026
28Monitor	CVE-2026-98471No exploit	KVM: SEV: Do cache maintenance on the source VM during intra-host migrationlinux · linux	High7.1	—	0.1%	Oct 18, 2026
30Monitor	CVE-2026-98479No exploit	scsi: libiscsi_tcp: Check the data direction of a Data-In PDUlinux · linux Pre-auth	High7.5	—	0.3%	Oct 18, 2026
28Monitor	CVE-2026-98485No exploit	netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds readlinux · linux	High7.1	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98487No exploit	net: bridge: mdb: restart port group walk after deletionlinux · linux	High7.8	—	0.1%	Oct 18, 2026
39Monitor	CVE-2026-98490No exploit	net: openvswitch: conntrack: fix helper UAF due to extensions realloclinux · linux Pre-auth	Critical9.8	—	0.6%	Oct 18, 2026
31Monitor	CVE-2026-98491No exploit	net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entrylinux · linux	High7.8	—	0.1%	Oct 18, 2026
30Monitor	CVE-2026-98497No exploit	net/mlx5e: fix swapped IPv6 IPsec policy maskslinux · linux	High7.5	—	0.4%	Oct 18, 2026
32Monitor	CVE-2026-98499Proof of concept	HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()linux · linux Pre-auth	High8.1	—	0.3%	Oct 18, 2026
28Monitor	CVE-2026-98501No exploit	HID: alps: fix use-after-free on input2 registration failurelinux · linux Pre-auth	High7.1	—	0.2%	Oct 18, 2026
31Monitor	CVE-2026-98507No exploit	mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publishlinux · linux	High7.8	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98510No exploit	drm/xe/vm: nuke PTs only after unlinking contested VMAslinux · linux	High7.8	—	0.1%	Oct 18, 2026
28Monitor	CVE-2026-98512No exploit	drm/nouveau: RCU-free the scheduler-containing nouveau_schedlinux · linux Local privilege escalation	High7.1	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98515No exploit	drm/nouveau: fix double-free in nvif_vmm_dtorlinux · linux	High7.8	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98517No exploit	drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEMlinux · linux	High7.8	—	0.1%	Oct 18, 2026
28Monitor	CVE-2026-98518No exploit	drm/nouveau/dmem: pin VRAM for the whole registered rangelinux · linux	High7.0	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98520No exploit	drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mappinglinux · linux	High7.8	—	0.1%	Oct 18, 2026
31Monitor	CVE-2026-98524No exploit	rds: ib: Clear the sg list when mapping an MR failslinux · linux Local privilege escalation	High7.8	—	0.1%	Oct 18, 2026
32Monitor	CVE-2026-98532No exploit	ipv6: do not let ipv6_find_hdr() return an offset past the packet endlinux · linux Pre-auth	High8.1	—	0.6%	Oct 18, 2026
29Monitor	CVE-2026-98543No exploit	bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdirlinux · linux	High7.3	—	0.1%	Oct 18, 2026
39Monitor	CVE-2026-98548No exploit	sctp: discard the rest of the packet on a stale-cookie errorlinux · linux Pre-auth	Critical9.8	—	0.6%	Oct 18, 2026
36Monitor	CVE-2026-98549No exploit	tcp: prevent collapsing skbs across boundary in rtx queuelinux · linux Pre-auth	Critical9.1	—	0.5%	Oct 18, 2026
30Monitor	CVE-2026-98550No exploit	tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflowlinux · linux Pre-auth Denial of service	High7.5	—	0.6%	Oct 18, 2026
30Monitor	CVE-2026-98555No exploit	llc: fix skb UAF and leaks on llc_mac_hdr_init() failurelinux · linux Pre-auth	High7.5	—	0.3%	Oct 18, 2026
36Monitor	CVE-2024-4457No exploit	Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Executionwso2 · wso2 enterprise integrator · CWE-78 pre-auth RCE Command injection	Critical9.1	—	0.4%	Oct 18, 2026
32Monitor	CVE-2026-107618No exploit	Gitea cross-site request forgery on repository topicsgitea · gitea · CWE-352 Pre-auth CSRF	High8.1	—	0.1%	Oct 18, 2026
30Monitor	CVE-2026-109553No exploit	Gitea SSH certificate principal impersonation of other usersgitea · gitea · CWE-287 Auth bypass	High7.5	—	0.1%	Oct 18, 2026

CVE-2026-104246
23Monitor
Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
unknown · contact form 7 signature addonOct 17, 2026
CVE-2026-110384
28Monitor
WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
heateor support · fancy comments wordpressOct 17, 2026
CVE-2026-100316
28Monitor
European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
davidanderson · european vat compliance assistant for woocommerceOct 17, 2026
CVE-2026-111110
28Monitor
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
stiofansisland · payment forms, buy now buttons, and invoicing system | getpaidOct 17, 2026
CVE-2026-110889
30Monitor
WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
gantry · gantry 5 frameworkOct 17, 2026
CVE-2026-109701
28Monitor
WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
paycomet · paycomet for woocommerceOct 17, 2026
CVE-2026-111880
33Monitor
FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpOct 17, 2026
CVE-2026-111881
28Monitor
FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpOct 17, 2026
CVE-2026-111882
34Monitor
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111884
34Monitor
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
HighCVSS 8.7No exploitEPSS 0%
- CSRF
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111885
28Monitor
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API
HighCVSS 7.0No exploitEPSS 0%
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111886
28Monitor
phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111890
28Monitor
phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights
HighCVSS 7.0No exploitEPSS 0%
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111891
28Monitor
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API
HighCVSS 7.0No exploitEPSS 0%
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111893
34Monitor
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API
HighCVSS 8.5No exploitEPSS 0%
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111895
30Monitor
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username
HighCVSS 7.6No exploitEPSS 0%
- Auth bypass
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111897
28Monitor
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111898
30Monitor
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
HighCVSS 7.7No exploitEPSS 0%
- Auth bypass
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111901
34Monitor
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111905
28Monitor
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
HighCVSS 7.0No exploitEPSS 0%
- Broken access control (IDOR)
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111906
28Monitor
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111907
28Monitor
phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111908
34Monitor
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111909
28Monitor
phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
HighCVSS 7.2No exploitEPSS 0%
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111910
28Monitor
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111911
37Monitor
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
thorsten · phpmyfaqOct 17, 2026
CVE-2026-111912
28Monitor
Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
- CSRF
admidio · admidioOct 17, 2026
CVE-2026-111914
28Monitor
Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
admidio · admidioOct 17, 2026
CVE-2026-111917
28Monitor
Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
HighCVSS 7.1No exploitEPSS 0%
go-vikunja · vikunjaOct 17, 2026
CVE-2026-111919
28Monitor
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
HighCVSS 7.1No exploitEPSS 0%
go-vikunja · vikunjaOct 17, 2026
CVE-2026-111922
28Monitor
Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
HighCVSS 7.2No exploitEPSS 0%
go-vikunja · vikunjaOct 17, 2026
CVE-2026-111923
34Monitor
Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
fleetdm · fleetOct 17, 2026
CVE-2026-111924
34Monitor
Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
fleetdm · fleetOct 17, 2026
CVE-2026-111927
34Monitor
Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
HighCVSS 8.7No exploitEPSS 0%
- Info leak
coder · coderOct 17, 2026
CVE-2026-110031
28Monitor
Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
HighCVSS 7.2No exploitEPSS 0%
unknown · salon booking systemOct 18, 2026
CVE-2026-110981
28Monitor
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · wp photo album plusOct 18, 2026
CVE-2026-96534
30Monitor
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
HighCVSS 7.7No exploitEPSS 0%
- SQL injection
unknown · modern events calendar liteOct 18, 2026
CVE-2026-107436
35Monitor
WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
wp chill · strong testimonialsOct 18, 2026
CVE-2026-108485
28Monitor
WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
themegrill · estoreOct 18, 2026
CVE-2026-109894
37Monitor
WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
arraytics · bookticsOct 18, 2026
CVE-2026-109895
28Monitor
WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
arraytics · bookticsOct 18, 2026
CVE-2026-110372
39Monitor
WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
brainstorm force · ottokitOct 18, 2026
CVE-2026-110373
32Monitor
WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
hamid alinia · login with phone numberOct 18, 2026
CVE-2026-110382
28Monitor
WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nsquared · simply schedule appointmentsOct 18, 2026
CVE-2026-110383
30Monitor
WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wp e-signature · electronic signature add-on for fluent formsOct 18, 2026
CVE-2026-110886
39Monitor
WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
quantumcloud · conversational forms for chatbotOct 18, 2026
CVE-2026-110895
34Monitor
WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
devitems · support genixOct 18, 2026
CVE-2026-110897
28Monitor
WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
ideabox creations · powerpack lite for beaver builderOct 18, 2026
RUSTSEC-2026-0414
30Monitor
Exponential event growth with `ENABLE_WIKILINKS`
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 18, 2026
CVE-2026-111998
37Monitor
Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
vanus-labs · vanusOct 18, 2026
CVE-2026-111999
34Monitor
Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
vanus-labs · vanusOct 18, 2026
CVE-2026-112000
28Monitor
Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
vanus-labs · vanusOct 18, 2026
CVE-2026-112001
34Monitor
ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
projectsend · projectsendOct 18, 2026
CVE-2026-112002
30Monitor
ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
HighCVSS 7.6No exploitEPSS 0%
projectsend · projectsendOct 18, 2026
CVE-2026-112005
36Monitor
WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Path traversal
clidey · whodbOct 18, 2026
CVE-2026-112006
33Monitor
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
opentelemetry · opentelemetry-exporter-otlp-proto-httpOct 18, 2026
CVE-2026-112015
30Monitor
Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
omnigent-ai · omnigentOct 18, 2026
CVE-2026-112017
28Monitor
JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
jeecgboot · jeecgbootOct 18, 2026
CVE-2026-112018
29Monitor
cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
jkuhlmann · cgltfOct 18, 2026
CVE-2026-112021
34Monitor
snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
grunfink · snac2Oct 18, 2026
CVE-2026-78497
33Monitor
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
HighCVSS 8.4No exploitEPSS 0%
- RCE
Oct 18, 2026
CVE-2026-112051
33Monitor
Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Path traversal
xorbitsai · inferenceOct 18, 2026
CVE-2026-98436
31Monitor
accel/amdxdna: Disable device buffer exporting
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98440
28Monitor
KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98441
31Monitor
net/sched: act_ct: avoid modifying shared unconfirmed ct entry
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98442
31Monitor
net/sched: act_ct: fix helper UAF due to extensions realloc
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98443
31Monitor
xfs: fix cursor and pointer handling when recovering iunlink buckets
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98451
35Monitor
smb: client: use finish_no_open() for non-regular inodes
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98454
32Monitor
smb: client: fix create context out-of-bounds reads
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98456
28Monitor
Bluetooth: mgmt: fix race in read_unconf_index_list()
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98464
37Monitor
RISC-V: KVM: Synchronize hrtimer callback during teardown
CriticalCVSS 9.3No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98465
28Monitor
RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98466
32Monitor
KVM: arm64: Transfer the hyp stack pages out of the host stage-2
HighCVSS 8.2No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98469
28Monitor
KVM: arm64: Fix AArch32 DBGBXVR<n> handling
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
linux · linuxOct 18, 2026
CVE-2026-98471
28Monitor
KVM: SEV: Do cache maintenance on the source VM during intra-host migration
HighCVSS 7.1No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98479
30Monitor
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98485
28Monitor
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
HighCVSS 7.1No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98487
31Monitor
net: bridge: mdb: restart port group walk after deletion
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98490
39Monitor
net: openvswitch: conntrack: fix helper UAF due to extensions realloc
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98491
31Monitor
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98497
30Monitor
net/mlx5e: fix swapped IPv6 IPsec policy masks
HighCVSS 7.5No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98499
32Monitor
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98501
28Monitor
HID: alps: fix use-after-free on input2 registration failure
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98507
31Monitor
mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98510
31Monitor
drm/xe/vm: nuke PTs only after unlinking contested VMAs
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98512
28Monitor
drm/nouveau: RCU-free the scheduler-containing nouveau_sched
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
linux · linuxOct 18, 2026
CVE-2026-98515
31Monitor
drm/nouveau: fix double-free in nvif_vmm_dtor
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98517
31Monitor
drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98518
28Monitor
drm/nouveau/dmem: pin VRAM for the whole registered range
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98520
31Monitor
drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98524
31Monitor
rds: ib: Clear the sg list when mapping an MR fails
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxOct 18, 2026
CVE-2026-98532
32Monitor
ipv6: do not let ipv6_find_hdr() return an offset past the packet end
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98543
29Monitor
bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
HighCVSS 7.3No exploitEPSS 0%
linux · linuxOct 18, 2026
CVE-2026-98548
39Monitor
sctp: discard the rest of the packet on a stale-cookie error
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98549
36Monitor
tcp: prevent collapsing skbs across boundary in rtx queue
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2026-98550
30Monitor
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxOct 18, 2026
CVE-2026-98555
30Monitor
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 18, 2026
CVE-2024-4457
36Monitor
Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
- Command injection
wso2 · wso2 enterprise integratorOct 18, 2026
CVE-2026-107618
32Monitor
Gitea cross-site request forgery on repository topics
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
gitea · giteaOct 18, 2026
CVE-2026-109553
30Monitor
Gitea SSH certificate principal impersonation of other users
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
gitea · giteaOct 18, 2026