By publication date

Exploited and new serious CVEs: October 2026

8,746 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 53 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-112306No exploit	NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFieldsnocobase · nocobase · CWE-89 SQL injection	High8.6	—	0.3%	Oct 19, 2026
33Monitor	CVE-2026-112307No exploit	sqlparse through 0.6.0 PHP Code Injection via output_format='php'andialbrecht · sqlparse · CWE-94 RCE	High8.4	—	0.1%	Oct 19, 2026
33Monitor	CVE-2026-112308No exploit	crewai-tools through 1.15.28 SSRF via SeleniumScrapingToolcrewaiinc · crewai-tools · CWE-918 Pre-auth SSRF	High8.3	—	0.2%	Oct 19, 2026
34Monitor	CVE-2026-112309No exploit	@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methodsairjp73 · @rvf/set-get · CWE-1321 Pre-auth Prototype pollution	High8.7	—	0.3%	Oct 19, 2026
34Monitor	CVE-2026-112366No exploit	Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patternsmicromatch · picomatch · CWE-1333 Pre-auth Denial of service	High8.7	—	0.3%	Oct 19, 2026
32Monitor	CVE-2026-112368No exploit	Unbounded Recursion in phongo_bson_visit_document/visit_array:mongodb inc. · php driver · CWE-674 Pre-auth Denial of service	High8.2	—	0.2%	Oct 19, 2026
32Monitor	CVE-2025-10149No exploit	Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeoverwso2 · wso2 identity server as key manager · CWE-281 Pre-auth	High8.2	—	0.1%	Oct 19, 2026
35Monitor	CVE-2026-103038No exploit	PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP hoststreamsoft · pingtools network utilities · CWE-78 RCE Command injection	High8.6	—	3.4%	Oct 19, 2026
35Monitor	CVE-2026-107082Proof of concept	Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and CWE-89 SQL injection	High8.8	—	0.4%	Oct 19, 2026
39Monitor	CVE-2026-107083Proof of concept	SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_CWE-89 Pre-auth SQL injection	Critical9.8	—	0.4%	Oct 19, 2026
34Monitor	CVE-2026-107186No exploit	Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuseeptura · archibus · CWE-287 Pre-auth Auth bypass	High8.6	—	0.3%	Oct 19, 2026
34Monitor	CVE-2026-107187No exploit	Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tableseptura · archibus · CWE-200 Auth bypass Info leak	High8.5	—	0.2%	Oct 19, 2026
38Monitor	CVE-2026-107188No exploit	Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Executioneptura · archibus · CWE-434 RCE Auth bypass File upload	Critical9.6	—	0.3%	Oct 19, 2026
35Monitor	CVE-2026-10572No exploit	IBM MQ Buffer Overflowibm · mq operator · CWE-122 RCE Memory safety	High8.8	—	0.4%	Oct 19, 2026
35Monitor	CVE-2026-10574No exploit	IBM MQ Buffer Overflowibm · mq operator · CWE-122 RCE Memory safety	High8.8	—	0.4%	Oct 19, 2026
35Monitor	CVE-2026-10743No exploit	IBM MQ Race Conditionibm · mq operator · CWE-1223 Race condition	High8.8	—	0.2%	Oct 19, 2026
32Monitor	CVE-2026-111064No exploit	aiohttp server lacks an initial request/header timeoutaio-libs · aiohttp · CWE-770 Pre-auth Denial of service	High8.2	—	0.3%	Oct 19, 2026
32Monitor	CVE-2026-111066No exploit	AIOHTTP: File descriptor exhaustion in multipart requestsaio-libs · aiohttp · CWE-400 Pre-auth Denial of service	High8.2	—	0.4%	Oct 19, 2026
39Monitor	CVE-2026-111862No exploit	Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Coderankmath · rank math seo pro · CWE-506 Pre-auth	Critical9.8	—	0.6%	Oct 19, 2026
10Monitor	CVE-2026-112195Proof of concept	FusionPBX Dialplan Editor dialplan.php os command injectionCWE-77 RCE Command injection	Low2.0	—	5.0%	Oct 19, 2026
35Monitor	CVE-2026-12148No exploit	IBM MQ Deserialization of Untrusted Dataibm · mq operator · CWE-502 RCE Deserialization	High8.8	—	0.3%	Oct 19, 2026
39Monitor	CVE-2026-12665No exploit	IBM MQ Buffer Overflowibm · mq operator · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	0.3%	Oct 19, 2026
30Monitor	CVE-2026-6930No exploit	IBM Concert Software Risky Cryptographic Algorithmibm · concert · CWE-327 Pre-auth Weak crypto	High7.5	—	0.1%	Oct 19, 2026
30Monitor	CVE-2025-52290No exploit	A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cauCWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 19, 2026
34Monitor	CVE-2026-105810Proof of concept	Authenticated Local Stack Overflow in TP-Link Tapo C320WStp-link systems inc. · tapo c320ws v2 · CWE-121 Memory safety	High8.5	—	0.4%	Oct 19, 2026
35Monitor	CVE-2026-107084Proof of concept	Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_hiCWE-352 Pre-auth CSRF	High8.8	—	0.2%	Oct 19, 2026
32Monitor	CVE-2026-111755No exploit	follow-redirects sensitiveHeaders regex escaping can expose credential headersfollow-redirects · follow-redirects · CWE-185 Pre-auth	High8.2	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-111759No exploit	markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesmarkdown-it · markdown-it · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 19, 2026
36Monitor	CVE-2026-112377No exploit	CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attackccc-attestation · attested-tls-poc · CWE-346 Pre-auth	Critical9.1	—	0.2%	Oct 19, 2026
30Monitor	CVE-2026-3161No exploit	IBM Cloud Pak System Risky Cryptographic Algorithmibm · cloud pak system · CWE-327 Pre-auth Weak crypto	High7.5	—	0.1%	Oct 19, 2026
30Monitor	CVE-2026-6719No exploit	IBM Concert Software Use of Insufficiently Random Valuesibm · concert · CWE-330 Pre-auth Weak crypto	High7.5	—	0.3%	Oct 19, 2026
36Monitor	CVE-2026-109437No exploit	Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backendcognicellai · cognition · CWE-306 pre-auth RCE Auth bypass	Critical9.2	—	0.7%	Oct 19, 2026
30Monitor	CVE-2026-110672No exploit	Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hvCWE-401 Pre-auth Denial of service	High7.5	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-110673No exploit	Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tagCWE-674 Pre-auth Denial of service	High7.5	—	0.4%	Oct 19, 2026
32Monitor	CVE-2026-110675No exploit	Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hvCWE-1286	High8.1	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-110676No exploit	Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignumCWE-405 Pre-auth Denial of service	High7.5	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-110677No exploit	Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hvCWE-401 Pre-auth Denial of service	High7.5	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-110678No exploit	Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parseCWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-110680No exploit	Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hvCWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 19, 2026
32Monitor	CVE-2026-110681No exploit	Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithreadCWE-416 Memory safety	High8.1	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-110682No exploit	Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parseCWE-436 Pre-auth	High7.5	—	0.4%	Oct 19, 2026
32Monitor	CVE-2026-110684No exploit	Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringifyCWE-401 Denial of service	High8.1	—	0.4%	Oct 19, 2026
36Monitor	CVE-2026-110685No exploit	Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tagCWE-401 Pre-auth Denial of service	Critical9.1	—	0.5%	Oct 19, 2026
30Monitor	CVE-2026-110687No exploit	Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmpCWE-176 Pre-auth	High7.5	—	0.4%	Oct 19, 2026
30Monitor	CVE-2026-110688No exploit	Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parseCWE-407 Pre-auth Denial of service	High7.5	—	0.4%	Oct 19, 2026
28Monitor	CVE-2026-112260No exploit	Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsingred hat · red hat enterprise linux 10 · CWE-125 Memory safety	High7.1	—	0.1%	Oct 19, 2026
34Monitor	CVE-2026-112770No exploit	Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callablecraftcms · cms · CWE-94 RCE	High8.7	—	0.7%	Oct 19, 2026
28Monitor	CVE-2026-112771No exploit	Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filterscraftcms · cms · CWE-200 Info leak	High7.1	—	0.3%	Oct 19, 2026
34Monitor	CVE-2026-112772No exploit	Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injectioncraftcms · cms · CWE-94 RCE	High8.7	—	0.7%	Oct 19, 2026
34Monitor	CVE-2026-112773No exploit	Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injectioncraftcms · cms · CWE-94 RCE	High8.7	—	0.7%	Oct 19, 2026
34Monitor	CVE-2026-112774No exploit	Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layoutcraftcms · cms · CWE-94 RCE	High8.7	—	0.6%	Oct 19, 2026
34Monitor	CVE-2026-112775No exploit	Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-passwordcraftcms · cms · CWE-287 Pre-auth Auth bypass	High8.7	—	0.4%	Oct 19, 2026
37Monitor	CVE-2026-112776No exploit	Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutationscraftcms · cms · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.3%	Oct 19, 2026
34Monitor	CVE-2026-112777No exploit	Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCEcraftcms · cms · CWE-184 pre-auth RCE	High8.7	—	0.6%	Oct 19, 2026
37Monitor	CVE-2026-112779No exploit	Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypassgetgrav · grav-plugin-api · CWE-770 Pre-auth Denial of service	Critical9.3	—	0.7%	Oct 19, 2026
37Monitor	CVE-2026-112780No exploit	Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@getgrav · grav · CWE-749 Pre-auth	Critical9.3	—	0.7%	Oct 19, 2026
34Monitor	CVE-2026-112781No exploit	Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directivesgetgrav · grav · CWE-200 Pre-auth Info leak	High8.7	—	0.6%	Oct 19, 2026
34Monitor	CVE-2026-112782No exploit	Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Servicegetgrav · grav · CWE-400 Pre-auth Denial of service	High8.7	—	0.7%	Oct 19, 2026
28Monitor	CVE-2026-71169No exploit	Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability.dell · application store · CWE-732 Local privilege escalation	High7.0	—	0.1%	Oct 19, 2026
31Monitor	CVE-2026-71170No exploit	Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability.dell · application store · CWE-427 RCE Local privilege escalation	High7.8	—	0.1%	Oct 19, 2026
35Monitor	CVE-2026-82166No exploit	Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability.dell · application store · CWE-306 pre-auth RCE Auth bypass	High8.8	—	0.2%	Oct 19, 2026
32Monitor	CVE-2026-112390No exploit	Pillow: Infinite loop in MIC n_frames when the embedded TIFFpython · pillow · CWE-835 Pre-auth Denial of service	High8.2	—	0.5%	Oct 19, 2026
36Monitor	CVE-2026-112393No exploit	Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython · pillow · CWE-122 Pre-auth Memory safety	Critical9.2	—	1.0%	Oct 19, 2026
32Monitor	CVE-2026-112395No exploit	Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)python · pillow · CWE-122 Pre-auth Memory safety	High8.2	—	0.5%	Oct 19, 2026
35Monitor	CVE-2026-76788No exploit	Stack out-of-bounds write in the OSDP Control Panel reply parserzephyrproject · zephyr · CWE-787 Pre-auth Memory safety	High8.8	—	0.2%	Oct 19, 2026
28Monitor	CVE-2026-105815No exploit	Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210tp-link systems inc. · tapo c210 v3.6 · CWE-287 Pre-auth Auth bypass	High7.1	—	0.2%	Oct 19, 2026
31Monitor	CVE-2026-112257No exploit	Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)red hat · red hat enterprise linux 10 · CWE-121 RCE Memory safety	High7.8	—	0.1%	Oct 19, 2026
31Monitor	CVE-2026-112258No exploit	Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channelsred hat · red hat enterprise linux 10 · CWE-416 RCE Memory safety	High7.8	—	0.1%	Oct 19, 2026
31Monitor	CVE-2026-112261No exploit	Gimp: gimp: use-after-free in xcf loader via prop_selected_pathred hat · red hat enterprise linux 10 · CWE-416 RCE Memory safety	High7.8	—	0.1%	Oct 19, 2026
29Monitor	CVE-2026-112360No exploit	Netis EAP930 CGI Endpoint debug return200 backdoornetis · eap930 · CWE-912	High7.4	—	0.4%	Oct 19, 2026
32Monitor	CVE-2026-112392No exploit	Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagespython · pillow · CWE-476 Pre-auth Memory safety	High8.2	—	0.5%	Oct 19, 2026
30Monitor	CVE-2026-112396No exploit	Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferpython · pillow · CWE-416 Pre-auth Memory safety Denial of service	High7.5	—	0.6%	Oct 19, 2026
34Monitor	CVE-2026-112397No exploit	Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagepython · pillow · CWE-787 Pre-auth Memory safety	High8.7	—	0.5%	Oct 19, 2026
36Monitor	CVE-2026-112398Proof of concept	Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionpython · pillow · CWE-122 pre-auth RCE Memory safety	Critical9.2	—	0.6%	Oct 19, 2026
34Monitor	CVE-2026-112399No exploit	Pillow: APNG background disposal allocates full canvas before decompression bomb checkpython · pillow · CWE-789 Pre-auth	High8.7	—	0.5%	Oct 19, 2026
34Monitor	CVE-2026-112400No exploit	Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSpython · pillow · CWE-400 Pre-auth Denial of service	High8.7	—	0.5%	Oct 19, 2026
34Monitor	CVE-2026-112402No exploit	Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformpython · pillow · CWE-416 Pre-auth Memory safety	High8.7	—	0.5%	Oct 19, 2026
36Monitor	CVE-2026-112403Proof of concept	Pillow: Heap buffer overflow in ImagingJpegDecodepython · pillow · CWE-122 Pre-auth Memory safety	Critical9.2	—	0.9%	Oct 19, 2026
35Monitor	CVE-2026-112404No exploit	Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelspython · pillow · CWE-126 Pre-auth	High8.8	—	0.4%	Oct 19, 2026
34Monitor	CVE-2026-112405No exploit	Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0python · pillow · CWE-476 Pre-auth Memory safety	High8.7	—	0.5%	Oct 19, 2026
34Monitor	CVE-2026-112406No exploit	Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclepython · pillow · CWE-835 Pre-auth Denial of service	High8.7	—	0.5%	Oct 19, 2026
34Monitor	CVE-2026-112892No exploit	Pillow: MSP RLE decoder expands a tiny file into unbounded memorypython · pillow · CWE-409 Pre-auth	High8.7	—	0.5%	Oct 19, 2026
32Monitor	CVE-2026-112893No exploit	Pillow: Invalid free in FreeType glyph rendering when a stroker is activepython · pillow · CWE-457 Pre-auth	High8.2	—	0.5%	Oct 19, 2026
34Monitor	CVE-2026-112894No exploit	Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)python · pillow · CWE-407 Pre-auth	High8.7	—	0.5%	Oct 19, 2026
34Monitor	CVE-2026-112895No exploit	Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)python · pillow · CWE-674 Pre-auth Denial of service	High8.7	—	0.5%	Oct 19, 2026
35Monitor	CVE-2026-112896No exploit	Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readpython · pillow · CWE-125 Pre-auth Memory safety	High8.8	—	0.4%	Oct 19, 2026
34Monitor	CVE-2026-112897No exploit	Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripspython · pillow · CWE-908 Pre-auth Memory safety	High8.7	—	0.4%	Oct 19, 2026
36Monitor	CVE-2026-112900Proof of concept	Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython · pillow · CWE-78 pre-auth RCE Command injection	Critical9.2	—	1.3%	Oct 19, 2026
35Monitor	CVE-2026-53995Proof of concept	MLflow 3.17.1 and prior Path Traversal via Trace ID APImlflow · mlflow · CWE-22 Pre-auth Path traversal	High8.8	—	0.6%	Oct 19, 2026
35Monitor	CVE-2026-112370No exploit	H3C Magic NX15 usrlist sub_416874 os command injectionh3c · magic nx15 · CWE-77 RCE Command injection	High8.6	—	2.0%	Oct 19, 2026
34Monitor	CVE-2026-112371No exploit	H3C Magic NX15 RPC esps write code injectionh3c · magic nx15 · CWE-74 RCE	High8.6	—	0.5%	Oct 19, 2026
33Monitor	CVE-2026-105453No exploit	IBM Sterling Connect:Direct for Unix Improper Privilege Managementibm · sterling connect direct for unix · CWE-269 Local privilege escalation	High8.4	—	0.1%	Oct 20, 2026
33Monitor	CVE-2026-107366No exploit	Langflow OSS Authorization Bypass Through User-Controlled Keylangflow · langflow · CWE-639 Broken access control (IDOR)	High8.3	—	0.3%	Oct 20, 2026
35Monitor	CVE-2026-107400No exploit	Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authenticationibm · tririga application platform · CWE-287 RCE Auth bypass	High8.8	—	0.5%	Oct 20, 2026
35Monitor	CVE-2026-109126No exploit	IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentialsibm · verify identity access · CWE-798 Pre-auth Hard-coded credentials	High8.8	—	0.2%	Oct 20, 2026
30Monitor	CVE-2026-105297No exploit	Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitscloudflare · https://github.com/cloudflare/pingora · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-109395No exploit	Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoderning · compress-lzf · CWE-125 Pre-auth Memory safety	High8.8	—	0.5%	Oct 20, 2026
34Monitor	CVE-2026-109440No exploit	LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCodeginlix-ai · langalpha · CWE-1427 pre-auth RCE	High8.7	—	0.6%	Oct 20, 2026
37Monitor	CVE-2026-109442No exploit	piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shellcas-bigdatalab · piflow · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.8%	Oct 20, 2026
34Monitor	CVE-2026-109443No exploit	JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shelljd-opensource · joysafeter · CWE-653 RCE	High8.7	—	0.8%	Oct 20, 2026

CVE-2026-112306
34Monitor
NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
nocobase · nocobaseOct 19, 2026
CVE-2026-112307
33Monitor
sqlparse through 0.6.0 PHP Code Injection via output_format='php'
HighCVSS 8.4No exploitEPSS 0%
- RCE
andialbrecht · sqlparseOct 19, 2026
CVE-2026-112308
33Monitor
crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- SSRF
crewaiinc · crewai-toolsOct 19, 2026
CVE-2026-112309
34Monitor
@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Prototype pollution
airjp73 · @rvf/set-getOct 19, 2026
CVE-2026-112366
34Monitor
Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
micromatch · picomatchOct 19, 2026
CVE-2026-112368
32Monitor
Unbounded Recursion in phongo_bson_visit_document/visit_array:
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
mongodb inc. · php driverOct 19, 2026
CVE-2025-10149
32Monitor
Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
wso2 · wso2 identity server as key managerOct 19, 2026
CVE-2026-103038
35Monitor
PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host
HighCVSS 8.6No exploitEPSS 3%
- RCE
- Command injection
streamsoft · pingtools network utilitiesOct 19, 2026
CVE-2026-107082
35Monitor
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and
HighCVSS 8.8Proof of conceptEPSS 0%
- SQL injection
Oct 19, 2026
CVE-2026-107083
39Monitor
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
Oct 19, 2026
CVE-2026-107186
34Monitor
Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
eptura · archibusOct 19, 2026
CVE-2026-107187
34Monitor
Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
- Info leak
eptura · archibusOct 19, 2026
CVE-2026-107188
38Monitor
Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
CriticalCVSS 9.6No exploitEPSS 0%
- RCE
- Auth bypass
- File upload
eptura · archibusOct 19, 2026
CVE-2026-10572
35Monitor
IBM MQ Buffer Overflow
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Memory safety
ibm · mq operatorOct 19, 2026
CVE-2026-10574
35Monitor
IBM MQ Buffer Overflow
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Memory safety
ibm · mq operatorOct 19, 2026
CVE-2026-10743
35Monitor
IBM MQ Race Condition
HighCVSS 8.8No exploitEPSS 0%
- Race condition
ibm · mq operatorOct 19, 2026
CVE-2026-111064
32Monitor
aiohttp server lacks an initial request/header timeout
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
aio-libs · aiohttpOct 19, 2026
CVE-2026-111066
32Monitor
AIOHTTP: File descriptor exhaustion in multipart requests
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
aio-libs · aiohttpOct 19, 2026
CVE-2026-111862
39Monitor
Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
rankmath · rank math seo proOct 19, 2026
CVE-2026-112195
10Monitor
FusionPBX Dialplan Editor dialplan.php os command injection
LowCVSS 2.0Proof of conceptEPSS 5%
- RCE
- Command injection
Oct 19, 2026
CVE-2026-12148
35Monitor
IBM MQ Deserialization of Untrusted Data
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
ibm · mq operatorOct 19, 2026
CVE-2026-12665
39Monitor
IBM MQ Buffer Overflow
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · mq operatorOct 19, 2026
CVE-2026-6930
30Monitor
IBM Concert Software Risky Cryptographic Algorithm
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
ibm · concertOct 19, 2026
CVE-2025-52290
30Monitor
A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cau
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-105810
34Monitor
Authenticated Local Stack Overflow in TP-Link Tapo C320WS
HighCVSS 8.5Proof of conceptEPSS 0%
- Memory safety
tp-link systems inc. · tapo c320ws v2Oct 19, 2026
CVE-2026-107084
35Monitor
Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_hi
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- CSRF
Oct 19, 2026
CVE-2026-111755
32Monitor
follow-redirects sensitiveHeaders regex escaping can expose credential headers
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
follow-redirects · follow-redirectsOct 19, 2026
CVE-2026-111759
30Monitor
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
markdown-it · markdown-itOct 19, 2026
CVE-2026-112377
36Monitor
CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
ccc-attestation · attested-tls-pocOct 19, 2026
CVE-2026-3161
30Monitor
IBM Cloud Pak System Risky Cryptographic Algorithm
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
ibm · cloud pak systemOct 19, 2026
CVE-2026-6719
30Monitor
IBM Concert Software Use of Insufficiently Random Values
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
ibm · concertOct 19, 2026
CVE-2026-109437
36Monitor
Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
cognicellai · cognitionOct 19, 2026
CVE-2026-110672
30Monitor
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-110673
30Monitor
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-110675
32Monitor
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv
HighCVSS 8.1No exploitEPSS 0%
Oct 19, 2026
CVE-2026-110676
30Monitor
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-110677
30Monitor
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-110678
30Monitor
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-110680
30Monitor
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Oct 19, 2026
CVE-2026-110681
32Monitor
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread
HighCVSS 8.1No exploitEPSS 0%
- Memory safety
Oct 19, 2026
CVE-2026-110682
30Monitor
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 19, 2026
CVE-2026-110684
32Monitor
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify
HighCVSS 8.1No exploitEPSS 0%
- Denial of service
Oct 19, 2026
CVE-2026-110685
36Monitor
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-110687
30Monitor
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 19, 2026
CVE-2026-110688
30Monitor
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 19, 2026
CVE-2026-112260
28Monitor
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
red hat · red hat enterprise linux 10Oct 19, 2026
CVE-2026-112770
34Monitor
Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
HighCVSS 8.7No exploitEPSS 0%
- RCE
craftcms · cmsOct 19, 2026
CVE-2026-112771
28Monitor
Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
HighCVSS 7.1No exploitEPSS 0%
- Info leak
craftcms · cmsOct 19, 2026
CVE-2026-112772
34Monitor
Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
HighCVSS 8.7No exploitEPSS 0%
- RCE
craftcms · cmsOct 19, 2026
CVE-2026-112773
34Monitor
Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
HighCVSS 8.7No exploitEPSS 0%
- RCE
craftcms · cmsOct 19, 2026
CVE-2026-112774
34Monitor
Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
HighCVSS 8.7No exploitEPSS 0%
- RCE
craftcms · cmsOct 19, 2026
CVE-2026-112775
34Monitor
Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
craftcms · cmsOct 19, 2026
CVE-2026-112776
37Monitor
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
craftcms · cmsOct 19, 2026
CVE-2026-112777
34Monitor
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
craftcms · cmsOct 19, 2026
CVE-2026-112779
37Monitor
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Denial of service
getgrav · grav-plugin-apiOct 19, 2026
CVE-2026-112780
37Monitor
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
getgrav · gravOct 19, 2026
CVE-2026-112781
34Monitor
Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
getgrav · gravOct 19, 2026
CVE-2026-112782
34Monitor
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
getgrav · gravOct 19, 2026
CVE-2026-71169
28Monitor
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability.
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
dell · application storeOct 19, 2026
CVE-2026-71170
31Monitor
Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
dell · application storeOct 19, 2026
CVE-2026-82166
35Monitor
Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability.
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
dell · application storeOct 19, 2026
CVE-2026-112390
32Monitor
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
python · pillowOct 19, 2026
CVE-2026-112393
36Monitor
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CriticalCVSS 9.2No exploitEPSS 1%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112395
32Monitor
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-76788
35Monitor
Stack out-of-bounds write in the OSDP Control Panel reply parser
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrOct 19, 2026
CVE-2026-105815
28Monitor
Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
tp-link systems inc. · tapo c210 v3.6Oct 19, 2026
CVE-2026-112257
31Monitor
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 10Oct 19, 2026
CVE-2026-112258
31Monitor
Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 10Oct 19, 2026
CVE-2026-112261
31Monitor
Gimp: gimp: use-after-free in xcf loader via prop_selected_path
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 10Oct 19, 2026
CVE-2026-112360
29Monitor
Netis EAP930 CGI Endpoint debug return200 backdoor
HighCVSS 7.4No exploitEPSS 0%
netis · eap930Oct 19, 2026
CVE-2026-112392
32Monitor
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112396
30Monitor
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
python · pillowOct 19, 2026
CVE-2026-112397
34Monitor
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112398
36Monitor
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CriticalCVSS 9.2Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112399
34Monitor
Pillow: APNG background disposal allocates full canvas before decompression bomb check
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
python · pillowOct 19, 2026
CVE-2026-112400
34Monitor
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
python · pillowOct 19, 2026
CVE-2026-112402
34Monitor
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112403
36Monitor
Pillow: Heap buffer overflow in ImagingJpegDecode
CriticalCVSS 9.2Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112404
35Monitor
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
python · pillowOct 19, 2026
CVE-2026-112405
34Monitor
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112406
34Monitor
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
python · pillowOct 19, 2026
CVE-2026-112892
34Monitor
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
python · pillowOct 19, 2026
CVE-2026-112893
32Monitor
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
python · pillowOct 19, 2026
CVE-2026-112894
34Monitor
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
python · pillowOct 19, 2026
CVE-2026-112895
34Monitor
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
python · pillowOct 19, 2026
CVE-2026-112896
35Monitor
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112897
34Monitor
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 19, 2026
CVE-2026-112900
36Monitor
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CriticalCVSS 9.2Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
python · pillowOct 19, 2026
CVE-2026-53995
35Monitor
MLflow 3.17.1 and prior Path Traversal via Trace ID API
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
mlflow · mlflowOct 19, 2026
CVE-2026-112370
35Monitor
H3C Magic NX15 usrlist sub_416874 os command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
h3c · magic nx15Oct 19, 2026
CVE-2026-112371
34Monitor
H3C Magic NX15 RPC esps write code injection
HighCVSS 8.6No exploitEPSS 0%
- RCE
h3c · magic nx15Oct 19, 2026
CVE-2026-105453
33Monitor
IBM Sterling Connect:Direct for Unix Improper Privilege Management
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
ibm · sterling connect direct for unixOct 20, 2026
CVE-2026-107366
33Monitor
Langflow OSS Authorization Bypass Through User-Controlled Key
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
langflow · langflowOct 20, 2026
CVE-2026-107400
35Monitor
Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Auth bypass
ibm · tririga application platformOct 20, 2026
CVE-2026-109126
35Monitor
IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
ibm · verify identity accessOct 20, 2026
CVE-2026-105297
30Monitor
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cloudflare · https://github.com/cloudflare/pingoraOct 20, 2026
CVE-2026-109395
35Monitor
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
ning · compress-lzfOct 20, 2026
CVE-2026-109440
34Monitor
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
ginlix-ai · langalphaOct 20, 2026
CVE-2026-109442
37Monitor
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
cas-bigdatalab · piflowOct 20, 2026
CVE-2026-109443
34Monitor
JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell
HighCVSS 8.7No exploitEPSS 0%
- RCE
jd-opensource · joysafeterOct 20, 2026