By publication date

Exploited and new serious CVEs: October 2026

8,745 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 52 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
26Monitor	CVE-2026-97859Proof of concept	Gitea API disclosure of private user social graph, keys and starsgitea · gitea · CWE-862 Broken access control (IDOR)	Medium6.5	—	0.3%	Oct 18, 2026
39Monitor	CVE-2026-108983No exploit	GV-ASManager Web Server Command Injection Vulnerabilitygeovision inc. · gv-asmanager · CWE-78 pre-auth RCE Command injection	Critical9.8	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-108984No exploit	GV-ASManager Web Server Buffer Overflow Vulnerabilitygeovision inc. · gv-asmanager · CWE-121 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 19, 2026
37Monitor	CVE-2026-102503No exploit	Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)google · sam · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.4%	Oct 19, 2026
37Monitor	CVE-2026-103091No exploit	Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)google · sam · CWE-200 Pre-auth Info leak	Critical9.3	—	0.6%	Oct 19, 2026
32Monitor	CVE-2026-111441No exploit	HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写opengauss-server · opengauss-server · CWE-122 Memory safety	High8.1	—	0.4%	Oct 19, 2026
28Monitor	CVE-2026-111440No exploit	JDBC LogFactory 任意类加载/构造导致潜在 RCEopengauss-server · opengauss-connector-jdbc · CWE-470 RCE	High7.0	—	0.1%	Oct 19, 2026
30Monitor	CVE-2026-108120No exploit	path traversal inKoozali - SME Serverkoozali · sme server · CWE-31 Pre-auth Path traversal	High7.7	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-112082No exploit	sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of servicesgl-project · sglang · CWE-404 Pre-auth	High7.7	—	0.6%	Oct 19, 2026
29Monitor	CVE-2026-16460No exploit	Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalizationred hat · red hat enterprise linux 10 · CWE-345	High7.4	—	0.0%	Oct 19, 2026
28Monitor	CVE-2026-76740No exploit	HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerabilityhewlett packard enterprise · hpe compute scale-up server 3200 platform · CWE-78 RCE Command injection	High7.2	—	0.4%	Oct 19, 2026
34Monitor	CVE-2026-112161No exploit	Lack of integrity checks in Mobatek’s MobaXtermmobatek · mobaxterm · CWE-345 Local privilege escalation	High8.5	—	0.0%	Oct 19, 2026
28Monitor	CVE-2026-112178No exploit	MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Controlmisp · misp · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 19, 2026
35Monitor	CVE-2026-13695No exploit	SQL Injection in the Integratec Applicationintegratec · integratec · CWE-89 Pre-auth SQL injection	High8.8	—	0.2%	Oct 19, 2026
29Monitor	CVE-2026-108762No exploit	Apache Kylin: delete metadata backup path-confinement bypassapache software foundation · apache kylin · CWE-22 Pre-auth Path traversal	High7.3	—	0.3%	Oct 19, 2026
39Monitor	CVE-2026-108771No exploit	Apache Kylin: unauthenticated broadcast API and polymorphic deserializationapache software foundation · apache kylin · CWE-306 Pre-auth Auth bypass Deserialization	Critical9.8	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-108823No exploit	Apache Kylin: Potential unauthenticated job metadata replacementapache software foundation · apache kylin · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-108833No exploit	Apache Kylin: default startup profile miss security settingsapache software foundation · apache kylin · CWE-1188 Pre-auth	High7.5	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-108837No exploit	Apache Kylin: Potential computed-column resource exhaustionapache software foundation · apache kylin · CWE-770 Pre-auth Denial of service	High7.5	—	0.3%	Oct 19, 2026
28Monitor	CVE-2026-110379No exploit	WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerabilityays pro · quiz maker · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 19, 2026
39Monitor	CVE-2026-110887No exploit	WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerabilityhivepress · hivepress · CWE-94 RCE	Critical9.9	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-111398No exploit	WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerabilitypt norther lights production · mapsvg · CWE-22 Path traversal Denial of service	High7.7	—	0.3%	Oct 19, 2026
39Monitor	CVE-2026-111406No exploit	WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerabilitypt norther lights production · mapsvg · CWE-434 File upload	Critical9.9	—	0.3%	Oct 19, 2026
35Monitor	CVE-2026-111408No exploit	WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerabilityexpresstech · quiz and survey master · CWE-502 Deserialization	High8.8	—	0.3%	Oct 19, 2026
28Monitor	CVE-2026-112188No exploit	MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolutionmisp · misp · CWE-200 Info leak	High7.1	—	0.2%	Oct 19, 2026
32Monitor	CVE-2026-64943No exploit	Apache Answer: API keys logged in plaintext during authenticationapache software foundation · apache answer · CWE-532 Info leak	High8.1	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-64945No exploit	Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questionsapache software foundation · apache answer · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-76994No exploit	Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profilesapache software foundation · apache answer · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Oct 19, 2026
39Monitor	CVE-2026-79624No exploit	Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocationapache software foundation · apache answer · CWE-613 Pre-auth	Critical9.8	—	0.3%	Oct 19, 2026
32Monitor	CVE-2026-79633No exploit	Apache Answer: Missing Authorization Allows Mutations of Non-Public Contentapache software foundation · apache answer · CWE-202	High8.1	—	0.2%	Oct 19, 2026
39Monitor	CVE-2026-90910No exploit	Apache Answer: Reaction API authorization bypass for restricted contentapache software foundation · apache answer · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 19, 2026
39Monitor	CVE-2026-71253No exploit	Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSONapache software foundation · apache johnzon · CWE-470 Pre-auth	Critical9.8	—	0.3%	Oct 19, 2026
40Plan	CVE-2026-78162Proof of concept	Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)apache · camel · CWE-502 Pre-auth Deserialization	Critical10.0	—	1.0%	Oct 19, 2026
23Monitor	CVE-2026-78163Proof of concept	Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosureapache software foundation · apache camel · CWE-22 Pre-auth SSRF Path traversal	Medium5.9	—	0.4%	Oct 19, 2026
32Monitor	CVE-2026-78164Proof of concept	Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headersapache software foundation · apache camel · CWE-200 Pre-auth Info leak	High8.2	—	0.3%	Oct 19, 2026
35Monitor	CVE-2026-78165Proof of concept	Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloadsapache software foundation · apache camel · CWE-502 Deserialization	High8.8	—	0.7%	Oct 19, 2026
36Monitor	CVE-2026-79983Proof of concept	Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directorapache · camel · CWE-22 Pre-auth Path traversal	Critical9.1	—	1.0%	Oct 19, 2026
29Monitor	CVE-2026-79984Proof of concept	Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the diapache software foundation · apache camel · CWE-22 Pre-auth Path traversal	High7.4	—	0.6%	Oct 19, 2026
29Monitor	CVE-2026-79985Proof of concept	Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directorapache software foundation · apache camel · CWE-22 Pre-auth Path traversal	High7.4	—	0.6%	Oct 19, 2026
36Monitor	CVE-2026-79986Proof of concept	Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the apache · camel · CWE-22 Pre-auth Path traversal	Critical9.1	—	1.0%	Oct 19, 2026
32Monitor	CVE-2026-80312Proof of concept	Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processorsapache software foundation · apache camel · CWE-287 Pre-auth Auth bypass	High8.2	—	0.5%	Oct 19, 2026
32Monitor	CVE-2026-80343Proof of concept	Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matchingapache · camel · CWE-178 Pre-auth	High8.2	—	0.9%	Oct 19, 2026
32Monitor	CVE-2026-80344Proof of concept	Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Addressapache · camel · CWE-918 Pre-auth SSRF	High8.2	—	0.8%	Oct 19, 2026
35Monitor	CVE-2026-83531Proof of concept	Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messagesapache software foundation · apache camel · CWE-94 RCE	High8.8	—	0.8%	Oct 19, 2026
26Monitor	CVE-2026-84176Proof of concept	Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflectionapache · camel · CWE-942 Pre-auth	Medium6.5	—	0.5%	Oct 19, 2026
24Monitor	CVE-2026-84178Proof of concept	Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flowapache software foundation · apache camel · CWE-352 Pre-auth CSRF	Medium6.1	—	0.1%	Oct 19, 2026
21Monitor	CVE-2026-84180Proof of concept	Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptionsapache · camel · CWE-209 Pre-auth Info leak	Medium5.3	—	0.6%	Oct 19, 2026
23Monitor	CVE-2026-84181Proof of concept	Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuseapache · camel · CWE-287 Pre-auth Auth bypass	Medium5.9	—	0.5%	Oct 19, 2026
23Monitor	CVE-2026-85243Proof of concept	Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structureapache · camel · CWE-354 Pre-auth	Medium5.9	—	0.3%	Oct 19, 2026
23Monitor	CVE-2026-85245Proof of concept	Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Targetapache · camel · CWE-488 Pre-auth Deserialization	Medium5.9	—	0.4%	Oct 19, 2026
21Monitor	CVE-2026-85246Proof of concept	Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptionsapache · camel · CWE-209 Pre-auth Info leak	Medium5.3	—	0.6%	Oct 19, 2026
23Monitor	CVE-2026-85247Proof of concept	Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststoreapache · camel · CWE-295 Pre-auth Weak crypto	Medium5.9	—	0.4%	Oct 19, 2026
23Monitor	CVE-2026-85248Proof of concept	Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instanceapache software foundation · apache camel · CWE-362 Pre-auth Race condition	Medium5.9	—	0.4%	Oct 19, 2026
26Monitor	CVE-2026-85249Proof of concept	Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadataapache · camel · CWE-20 Pre-auth	Medium6.5	—	0.6%	Oct 19, 2026
30Monitor	CVE-2026-85250Proof of concept	Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Optionapache · camel · CWE-611 Pre-auth XXE	High7.5	—	0.7%	Oct 19, 2026
30Monitor	CVE-2026-85251Proof of concept	Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targetsapache · camel · CWE-200 Pre-auth Info leak	High7.5	—	0.6%	Oct 19, 2026
26Monitor	CVE-2026-85254Proof of concept	Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casingapache · camel · CWE-178 Pre-auth	Medium6.5	—	0.6%	Oct 19, 2026
21Monitor	CVE-2026-85257Proof of concept	Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptionsapache · camel · CWE-209 Pre-auth Info leak	Medium5.3	—	0.6%	Oct 19, 2026
22Monitor	CVE-2026-85260Proof of concept	Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Defaultapache · camel · CWE-532 Info leak	Medium5.5	—	0.2%	Oct 19, 2026
26Monitor	CVE-2026-85296Proof of concept	Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request Stateapache · camel · CWE-488 Pre-auth	Medium6.5	—	0.6%	Oct 19, 2026
22Monitor	CVE-2026-85300Proof of concept	Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissionsapache software foundation · apache camel · CWE-276	Medium5.5	—	0.1%	Oct 19, 2026
19Monitor	CVE-2026-85301Proof of concept	Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claimapache software foundation · apache camel · CWE-287 Pre-auth Auth bypass	Medium4.8	—	0.3%	Oct 19, 2026
19Monitor	CVE-2026-85312Proof of concept	Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Headerapache · camel · CWE-20 Pre-auth	Medium4.8	—	0.5%	Oct 19, 2026
17Monitor	CVE-2026-85313Proof of concept	Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Setapache · camel · CWE-942 Pre-auth	Medium4.3	—	0.4%	Oct 19, 2026
26Monitor	CVE-2026-85314Proof of concept	Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)apache · camel · CWE-20 Pre-auth	Medium6.5	—	0.5%	Oct 19, 2026
21Monitor	CVE-2026-85315Proof of concept	Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptionsapache · camel · CWE-209 Pre-auth Info leak	Medium5.3	—	0.4%	Oct 19, 2026
19Monitor	CVE-2026-85316Proof of concept	Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matchingapache · camel · CWE-1220 Pre-auth	Medium4.8	—	0.4%	Oct 19, 2026
19Monitor	CVE-2026-85317Proof of concept	Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cacheapache · camel · CWE-524 Pre-auth	Medium4.8	—	0.5%	Oct 19, 2026
32Monitor	CVE-2026-88901Proof of concept	Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by defaultapache software foundation · apache camel · CWE-611 Pre-auth XXE	High8.2	—	0.4%	Oct 19, 2026
26Monitor	CVE-2026-91858Proof of concept	Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Presentapache software foundation · apache camel · CWE-611 Pre-auth XXE	Medium6.5	—	0.3%	Oct 19, 2026
35Monitor	CVE-2026-88900Proof of concept	Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Executionapache · camel · CWE-502 pre-auth RCE Deserialization	High8.8	—	0.6%	Oct 19, 2026
29Monitor	CVE-2026-103314No exploit	Stackrox: stackrox: saml response replay allows multiple central authentication tokensred hat · red hat advanced cluster security 4 · CWE-294 Pre-auth Auth bypass	High7.4	—	0.4%	Oct 19, 2026
32Monitor	CVE-2026-111915No exploit	Yank Note before 3.93.1 Path Traversal via /api/help Endpointpurocean · yank note · CWE-22 Pre-auth Path traversal	High8.2	—	0.4%	Oct 19, 2026
21Monitor	CVE-2026-112222Proof of concept	WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerabilitysurfer · surfer · CWE-862 Broken access control (IDOR)	Medium5.4	—	0.1%	Oct 19, 2026
28Monitor	CVE-2026-112262No exploit	RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectorsrisingwavelabs · risingwave · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 19, 2026
34Monitor	CVE-2026-112263No exploit	Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formattingalexpasmantier · television · CWE-78 RCE Local privilege escalation Command injection	High8.5	—	0.6%	Oct 19, 2026
34Monitor	CVE-2026-112264No exploit	BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keysbentoml · bentoml · CWE-78 RCE Command injection	High8.5	—	0.2%	Oct 19, 2026
33Monitor	CVE-2026-112265No exploit	LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verificationlangbot-app · langbot · CWE-345 Pre-auth	High8.3	—	0.1%	Oct 19, 2026
32Monitor	CVE-2026-112266No exploit	SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matchingsgl-project · sglang · CWE-187 Pre-auth	High8.2	—	0.4%	Oct 19, 2026
28Monitor	CVE-2026-112269No exploit	SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrationssgl-project · sglang · CWE-770 Pre-auth Denial of service	High7.1	—	0.4%	Oct 19, 2026
28Monitor	CVE-2026-112270No exploit	SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idxsgl-project · sglang · CWE-770 Pre-auth Denial of service	High7.1	—	0.2%	Oct 19, 2026
28Monitor	CVE-2026-112277No exploit	rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_planerdesktop · rdesktop · CWE-125 Pre-auth Memory safety	High7.1	—	0.3%	Oct 19, 2026
28Monitor	CVE-2026-112278No exploit	rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcacherdesktop · rdesktop · CWE-125 Pre-auth Memory safety	High7.1	—	0.3%	Oct 19, 2026
28Monitor	CVE-2026-112279No exploit	rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2rdesktop · rdesktop · CWE-125 Pre-auth Memory safety	High7.1	—	0.3%	Oct 19, 2026
28Monitor	CVE-2026-112286No exploit	Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpointskrayin · laravel-crm · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 19, 2026
28Monitor	CVE-2026-112287No exploit	Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Modulekrayin · laravel-crm · CWE-639 Broken access control (IDOR)	High7.1	—	0.1%	Oct 19, 2026
37Monitor	CVE-2026-112292No exploit	CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rulesoperacle · checkcle · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.3%	Oct 19, 2026
37Monitor	CVE-2026-112296No exploit	FlyCms through commit edfdf724 Default Super Administrator Credentialssunkaifei · flycms · CWE-1392 Pre-auth Hard-coded credentials	Critical9.3	—	0.4%	Oct 19, 2026
28Monitor	CVE-2026-8168No exploit	Denial-of-service vulnerability in the SVG parser and renderer impacts Qtqt · qt · CWE-674 Pre-auth Denial of service	High7.1	—	0.4%	Oct 19, 2026
39Monitor	CVE-2026-107081Proof of concept	SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.pCWE-89 Pre-auth SQL injection	Critical9.8	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-107567No exploit	Use of Less Trusted Source in hMailServerprogressive robot ltd · hmailserver · CWE-348 Pre-auth	High7.5	—	0.1%	Oct 19, 2026
30Monitor	CVE-2026-107569No exploit	Unchecked Input for Loop Condition in hMailServerprogressive robot ltd · hmailserver · CWE-606 Pre-auth Denial of service	High7.5	—	0.3%	Oct 19, 2026
31Monitor	CVE-2026-107571No exploit	Incorrect Default Permissions in hMailServerprogressive robot ltd · hmailserver · CWE-276 Local privilege escalation	High7.8	—	0.1%	Oct 19, 2026
34Monitor	CVE-2026-109431No exploit	Camunda Missing Authorization in Task Sub-Resourcescamunda · camunda 7 · CWE-639 Broken access control (IDOR)	High8.6	—	0.3%	Oct 19, 2026
37Monitor	CVE-2026-109432No exploit	Camunda Expression Injection via orQueries RCEcamunda · camunda 7 · CWE-78 pre-auth RCE Command injection	Critical9.3	—	0.5%	Oct 19, 2026
30Monitor	CVE-2026-111045No exploit	CLI Bridge: High-severity sandbox escape via dangling symlinkanshupriyan · cli-bridge · CWE-59 Pre-auth	High7.5	—	0.3%	Oct 19, 2026
40Plan	CVE-2026-111057No exploit	Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmljar · mercury · CWE-185 pre-auth RCE	Critical10.0	—	0.6%	Oct 19, 2026
39Monitor	CVE-2026-111058Proof of concept	Mercury: Unauthenticated Remote Code Execution via /api/kernelsmljar · mercury · CWE-862 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.5%	Oct 19, 2026
28Monitor	CVE-2026-112158No exploit	MikroTik RouterOS ipt_SAME.ko same_check integer overflowmikrotik · routeros · CWE-189	High7.1	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-112304No exploit	docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()mindee · doctr · CWE-502 pre-auth RCE Deserialization	High7.7	—	0.3%	Oct 19, 2026

CVE-2026-97859
26Monitor
Gitea API disclosure of private user social graph, keys and stars
MediumCVSS 6.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
gitea · giteaOct 18, 2026
CVE-2026-108983
39Monitor
GV-ASManager Web Server Command Injection Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
geovision inc. · gv-asmanagerOct 19, 2026
CVE-2026-108984
30Monitor
GV-ASManager Web Server Buffer Overflow Vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
geovision inc. · gv-asmanagerOct 19, 2026
CVE-2026-102503
37Monitor
Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
google · samOct 19, 2026
CVE-2026-103091
37Monitor
Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Info leak
google · samOct 19, 2026
CVE-2026-111441
32Monitor
HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
HighCVSS 8.1No exploitEPSS 0%
- Memory safety
opengauss-server · opengauss-serverOct 19, 2026
CVE-2026-111440
28Monitor
JDBC LogFactory 任意类加载/构造导致潜在 RCE
HighCVSS 7.0No exploitEPSS 0%
- RCE
opengauss-server · opengauss-connector-jdbcOct 19, 2026
CVE-2026-108120
30Monitor
path traversal inKoozali - SME Server
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Path traversal
koozali · sme serverOct 19, 2026
CVE-2026-112082
30Monitor
sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
sgl-project · sglangOct 19, 2026
CVE-2026-16460
29Monitor
Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
HighCVSS 7.4No exploitEPSS 0%
red hat · red hat enterprise linux 10Oct 19, 2026
CVE-2026-76740
28Monitor
HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Command injection
hewlett packard enterprise · hpe compute scale-up server 3200 platformOct 19, 2026
CVE-2026-112161
34Monitor
Lack of integrity checks in Mobatek’s MobaXterm
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
mobatek · mobaxtermOct 19, 2026
CVE-2026-112178
28Monitor
MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
misp · mispOct 19, 2026
CVE-2026-13695
35Monitor
SQL Injection in the Integratec Application
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SQL injection
integratec · integratecOct 19, 2026
CVE-2026-108762
29Monitor
Apache Kylin: delete metadata backup path-confinement bypass
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Path traversal
apache software foundation · apache kylinOct 19, 2026
CVE-2026-108771
39Monitor
Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Deserialization
apache software foundation · apache kylinOct 19, 2026
CVE-2026-108823
30Monitor
Apache Kylin: Potential unauthenticated job metadata replacement
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache kylinOct 19, 2026
CVE-2026-108833
30Monitor
Apache Kylin: default startup profile miss security settings
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache kylinOct 19, 2026
CVE-2026-108837
30Monitor
Apache Kylin: Potential computed-column resource exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache kylinOct 19, 2026
CVE-2026-110379
28Monitor
WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
ays pro · quiz makerOct 19, 2026
CVE-2026-110887
39Monitor
WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
hivepress · hivepressOct 19, 2026
CVE-2026-111398
30Monitor
WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
- Denial of service
pt norther lights production · mapsvgOct 19, 2026
CVE-2026-111406
39Monitor
WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
pt norther lights production · mapsvgOct 19, 2026
CVE-2026-111408
35Monitor
WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
expresstech · quiz and survey masterOct 19, 2026
CVE-2026-112188
28Monitor
MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
HighCVSS 7.1No exploitEPSS 0%
- Info leak
misp · mispOct 19, 2026
CVE-2026-64943
32Monitor
Apache Answer: API keys logged in plaintext during authentication
HighCVSS 8.1No exploitEPSS 0%
- Info leak
apache software foundation · apache answerOct 19, 2026
CVE-2026-64945
30Monitor
Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache software foundation · apache answerOct 19, 2026
CVE-2026-76994
30Monitor
Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache answerOct 19, 2026
CVE-2026-79624
39Monitor
Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
apache software foundation · apache answerOct 19, 2026
CVE-2026-79633
32Monitor
Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
HighCVSS 8.1No exploitEPSS 0%
apache software foundation · apache answerOct 19, 2026
CVE-2026-90910
39Monitor
Apache Answer: Reaction API authorization bypass for restricted content
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache answerOct 19, 2026
CVE-2026-71253
39Monitor
Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
apache software foundation · apache johnzonOct 19, 2026
CVE-2026-78162
40Plan
Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
CriticalCVSS 10.0Proof of conceptEPSS 1%
- Pre-auth
- Deserialization
apache · camelOct 19, 2026
CVE-2026-78163
23Monitor
Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- SSRF
- Path traversal
apache software foundation · apache camelOct 19, 2026
CVE-2026-78164
32Monitor
Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache camelOct 19, 2026
CVE-2026-78165
35Monitor
Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
HighCVSS 8.8Proof of conceptEPSS 0%
- Deserialization
apache software foundation · apache camelOct 19, 2026
CVE-2026-79983
36Monitor
Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the director
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
apache · camelOct 19, 2026
CVE-2026-79984
29Monitor
Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the di
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
apache software foundation · apache camelOct 19, 2026
CVE-2026-79985
29Monitor
Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the director
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
apache software foundation · apache camelOct 19, 2026
CVE-2026-79986
36Monitor
Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
apache · camelOct 19, 2026
CVE-2026-80312
32Monitor
Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache camelOct 19, 2026
CVE-2026-80343
32Monitor
Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-80344
32Monitor
Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- SSRF
apache · camelOct 19, 2026
CVE-2026-83531
35Monitor
Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
apache software foundation · apache camelOct 19, 2026
CVE-2026-84176
26Monitor
Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-84178
24Monitor
Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- CSRF
apache software foundation · apache camelOct 19, 2026
CVE-2026-84180
21Monitor
Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apache · camelOct 19, 2026
CVE-2026-84181
23Monitor
Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
apache · camelOct 19, 2026
CVE-2026-85243
23Monitor
Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85245
23Monitor
Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Deserialization
apache · camelOct 19, 2026
CVE-2026-85246
21Monitor
Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apache · camelOct 19, 2026
CVE-2026-85247
23Monitor
Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
apache · camelOct 19, 2026
CVE-2026-85248
23Monitor
Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance
MediumCVSS 5.9Proof of conceptEPSS 0%
- Pre-auth
- Race condition
apache software foundation · apache camelOct 19, 2026
CVE-2026-85249
26Monitor
Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85250
30Monitor
Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- XXE
apache · camelOct 19, 2026
CVE-2026-85251
30Monitor
Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apache · camelOct 19, 2026
CVE-2026-85254
26Monitor
Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85257
21Monitor
Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apache · camelOct 19, 2026
CVE-2026-85260
22Monitor
Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
MediumCVSS 5.5Proof of conceptEPSS 0%
- Info leak
apache · camelOct 19, 2026
CVE-2026-85296
26Monitor
Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85300
22Monitor
Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
MediumCVSS 5.5Proof of conceptEPSS 0%
apache software foundation · apache camelOct 19, 2026
CVE-2026-85301
19Monitor
Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache camelOct 19, 2026
CVE-2026-85312
19Monitor
Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85313
17Monitor
Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85314
26Monitor
Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85315
21Monitor
Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apache · camelOct 19, 2026
CVE-2026-85316
19Monitor
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-85317
19Monitor
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
apache · camelOct 19, 2026
CVE-2026-88901
32Monitor
Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
HighCVSS 8.2Proof of conceptEPSS 0%
- Pre-auth
- XXE
apache software foundation · apache camelOct 19, 2026
CVE-2026-91858
26Monitor
Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- XXE
apache software foundation · apache camelOct 19, 2026
CVE-2026-88900
35Monitor
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
HighCVSS 8.8Proof of conceptEPSS 0%
- pre-auth RCE
- Deserialization
apache · camelOct 19, 2026
CVE-2026-103314
29Monitor
Stackrox: stackrox: saml response replay allows multiple central authentication tokens
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
red hat · red hat advanced cluster security 4Oct 19, 2026
CVE-2026-111915
32Monitor
Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
purocean · yank noteOct 19, 2026
CVE-2026-112222
21Monitor
WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
MediumCVSS 5.4Proof of conceptEPSS 0%
- Broken access control (IDOR)
surfer · surferOct 19, 2026
CVE-2026-112262
28Monitor
RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
risingwavelabs · risingwaveOct 19, 2026
CVE-2026-112263
34Monitor
Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
alexpasmantier · televisionOct 19, 2026
CVE-2026-112264
34Monitor
BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
bentoml · bentomlOct 19, 2026
CVE-2026-112265
33Monitor
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
langbot-app · langbotOct 19, 2026
CVE-2026-112266
32Monitor
SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
sgl-project · sglangOct 19, 2026
CVE-2026-112269
28Monitor
SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
sgl-project · sglangOct 19, 2026
CVE-2026-112270
28Monitor
SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
sgl-project · sglangOct 19, 2026
CVE-2026-112277
28Monitor
rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
rdesktop · rdesktopOct 19, 2026
CVE-2026-112278
28Monitor
rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
rdesktop · rdesktopOct 19, 2026
CVE-2026-112279
28Monitor
rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
rdesktop · rdesktopOct 19, 2026
CVE-2026-112286
28Monitor
Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
krayin · laravel-crmOct 19, 2026
CVE-2026-112287
28Monitor
Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
krayin · laravel-crmOct 19, 2026
CVE-2026-112292
37Monitor
CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
operacle · checkcleOct 19, 2026
CVE-2026-112296
37Monitor
FlyCms through commit edfdf724 Default Super Administrator Credentials
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
sunkaifei · flycmsOct 19, 2026
CVE-2026-8168
28Monitor
Denial-of-service vulnerability in the SVG parser and renderer impacts Qt
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
qt · qtOct 19, 2026
CVE-2026-107081
39Monitor
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.p
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
Oct 19, 2026
CVE-2026-107567
30Monitor
Use of Less Trusted Source in hMailServer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
progressive robot ltd · hmailserverOct 19, 2026
CVE-2026-107569
30Monitor
Unchecked Input for Loop Condition in hMailServer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
progressive robot ltd · hmailserverOct 19, 2026
CVE-2026-107571
31Monitor
Incorrect Default Permissions in hMailServer
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
progressive robot ltd · hmailserverOct 19, 2026
CVE-2026-109431
34Monitor
Camunda Missing Authorization in Task Sub-Resources
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
camunda · camunda 7Oct 19, 2026
CVE-2026-109432
37Monitor
Camunda Expression Injection via orQueries RCE
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Command injection
camunda · camunda 7Oct 19, 2026
CVE-2026-111045
30Monitor
CLI Bridge: High-severity sandbox escape via dangling symlink
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
anshupriyan · cli-bridgeOct 19, 2026
CVE-2026-111057
40Plan
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
mljar · mercuryOct 19, 2026
CVE-2026-111058
39Monitor
Mercury: Unauthenticated Remote Code Execution via /api/kernels
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
mljar · mercuryOct 19, 2026
CVE-2026-112158
28Monitor
MikroTik RouterOS ipt_SAME.ko same_check integer overflow
HighCVSS 7.1No exploitEPSS 0%
mikrotik · routerosOct 19, 2026
CVE-2026-112304
30Monitor
docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Deserialization
mindee · doctrOct 19, 2026