By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 55 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2026-112942No exploit	launch-editor: `fs.existsSync()` existence check can be bypassed on Windowsvitejs · launch-editor · CWE-77 pre-auth RCE Command injection	High7.5	—	1.6%	Oct 20, 2026
33Monitor	CVE-2026-91186No exploit	PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds writeeclipse foundation · eclipse threadx - guix · CWE-125 Memory safety	High8.4	—	0.1%	Oct 20, 2026
28Monitor	CVE-2026-91189No exploit	GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or themeeclipse foundation · eclipse threadx - guix · CWE-190 Memory safety	High7.1	—	0.1%	Oct 20, 2026
28Monitor	CVE-2026-92162Proof of concept	Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstreamflatpak · flatpak · CWE-22 Path traversal Local privilege escalation	High7.2	—	0.2%	Oct 20, 2026
31Monitor	CVE-2026-95168No exploit	An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py andCWE-94 RCE	High7.8	—	0.2%	Oct 20, 2026
28Monitor	CVE-2025-71436No exploit	Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Taglibrdf · raptor rdf syntax library · CWE-122 Pre-auth Memory safety	High7.1	—	0.4%	Oct 20, 2026
30Monitor	CVE-2026-111764No exploit	A2A Java SDK has a fail-open default task authorizationa2aproject · a2a-java · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.6%	Oct 20, 2026
30Monitor	CVE-2026-111765No exploit	A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixa2aproject · a2a-java · CWE-522 Pre-auth Info leak	High7.5	—	0.8%	Oct 20, 2026
35Monitor	CVE-2026-112836No exploit	WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerabilitye4jvikwp · vikrentcar · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 20, 2026
34Monitor	CVE-2026-113605No exploit	Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-databasestirling-tools · stirling-pdf · CWE-184	High8.6	—	0.6%	Oct 20, 2026
28Monitor	CVE-2026-113606No exploit	Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Foldersstirling-tools · stirling-pdf · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Oct 20, 2026
28Monitor	CVE-2026-113607No exploit	Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_datajleyva · moodle-block_configurablereports · CWE-863 Broken access control (IDOR)	High7.1	—	0.4%	Oct 20, 2026
36Monitor	CVE-2026-113613No exploit	FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress pluginflexget · flexget · CWE-22 Pre-auth Path traversal	Critical9.2	—	0.9%	Oct 20, 2026
37Monitor	CVE-2026-113678No exploit	Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cronfroxlor · froxlor · CWE-59	Critical9.4	—	0.6%	Oct 20, 2026
29Monitor	CVE-2026-113679No exploit	HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_stringharfbuzz · harfbuzz · CWE-787 Memory safety	High7.3	—	0.1%	Oct 20, 2026
36Monitor	CVE-2026-113682No exploit	Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Passwordnetworknt · light-4j · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-113703No exploit	SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofinggiuseppe99barchetta · suggestarr · CWE-290 Pre-auth Auth bypass	Critical9.1	—	0.4%	Oct 20, 2026
37Monitor	CVE-2026-86471No exploit	Apache CouchDB: Admin credentials leading to code execution as operating system userapache software foundation · apache couchdb · CWE-78 RCE Command injection	Critical9.3	—	0.6%	Oct 20, 2026
30Monitor	CVE-2026-90797No exploit	Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionapache software foundation · apache couchdb · CWE-409 Pre-auth	High7.7	—	0.6%	Oct 20, 2026
32Monitor	CVE-2026-90800No exploit	Apache CouchDB: Auth bypass in prefixed _users and _replicator databasesapache software foundation · apache couchdb · CWE-862 Pre-auth Auth bypass Broken access control (IDOR)	High8.1	—	0.6%	Oct 20, 2026
34Monitor	CVE-2026-92843No exploit	Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secureeclipse foundation · eclipse threadx - netx duo · CWE-125 Pre-auth Memory safety	High8.7	—	0.2%	Oct 20, 2026
34Monitor	CVE-2026-92853No exploit	Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secureeclipse foundation · eclipse threadx - netx duo · CWE-125 Pre-auth Memory safety	High8.7	—	0.2%	Oct 20, 2026
37Monitor	CVE-2026-93475No exploit	Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509eclipse foundation · eclipse threadx - netx duo · CWE-787 Pre-auth Memory safety	Critical9.3	—	0.2%	Oct 20, 2026
35Monitor	CVE-2026-94018No exploit	NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow patheclipse foundation · eclipse threadx - netx duo · CWE-457 Pre-auth	High8.8	—	0.3%	Oct 20, 2026
34Monitor	CVE-2026-94192No exploit	Module object deallocation can free a live ThreadX kernel objecteclipse foundation · eclipse threadx · CWE-416 Memory safety	High8.5	—	0.1%	Oct 20, 2026
28Monitor	CVE-2026-95107No exploit	Module object allocation size overflow corrupts the manager object pooleclipse foundation · eclipse threadx · CWE-190 Memory safety	High7.0	—	0.1%	Oct 20, 2026
34Monitor	CVE-2026-95109No exploit	Cortex-A7 module data validation checks only the first address of a caller-supplied rangeeclipse foundation · eclipse threadx · CWE-125 Local privilege escalation Memory safety	High8.5	—	0.1%	Oct 20, 2026
30Monitor	CVE-2026-113658No exploit	ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryapostrophecms · apostrophe · CWE-400 Pre-auth CSRF Denial of service	High7.5	—	0.6%	Oct 20, 2026
35Monitor	CVE-2026-28328No exploit	SolarWinds Observability Self-Hosted broken authorization schemasolarwinds · solarwinds observability self-hosted · CWE-863 Broken access control (IDOR)	High8.8	—	0.4%	Oct 20, 2026
36Monitor	CVE-2026-105772No exploit	Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionIdgoogle · adk typescript (@google/adk) · CWE-22 Pre-auth Path traversal	Critical9.1	—	0.5%	Oct 20, 2026
32Monitor	CVE-2026-111756No exploit	follow-redirects array-form headers bypass cross-origin credential strippingfollow-redirects · follow-redirects · CWE-200 Pre-auth Info leak	High8.2	—	0.4%	Oct 20, 2026
35Monitor	CVE-2026-113506No exploit	aaPanel File Manager common.py ExecShell os command injectionCWE-77 RCE Command injection	High8.6	—	2.0%	Oct 20, 2026
28Monitor	CVE-2026-113666No exploit	ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceapostrophecms · apostrophe · CWE-400 Denial of service	High7.1	—	0.4%	Oct 20, 2026
39Monitor	CVE-2026-113672No exploit	Argo CD: A Jsonnet import can read files from the repo-serverargoproj · argo-cd · CWE-22 Path traversal	Critical9.9	—	0.8%	Oct 20, 2026
30Monitor	CVE-2026-113711No exploit	ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportapostrophecms · apostrophe · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 20, 2026
38Monitor	CVE-2026-113802No exploit	Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handlerwavlink · wl-wn530be1-a · CWE-78 pre-auth RCE Command injection	Critical9.3	—	3.4%	Oct 20, 2026
35Monitor	CVE-2026-100134No exploit	Acrobat for Edge \| Out-of-bounds Write (CWE-787)adobe · acrobat for edge · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.7%	Oct 20, 2026
34Monitor	CVE-2026-111767No exploit	MCP TypeScript SDK: Experimental tasks were not tied to the session that created themmodelcontextprotocol · typescript-sdk · CWE-639 Pre-auth Broken access control (IDOR)	High8.6	—	0.3%	Oct 20, 2026
39Monitor	CVE-2026-113708No exploit	Argo CD: A Kustomize remote ref can run commands in the repo-serverargoproj · argo-cd · CWE-88	Critical9.9	—	0.6%	Oct 20, 2026
39Monitor	CVE-2026-113709No exploit	Argo CD: A Kustomize Helm config home can run commands in the repo-serverargoproj · argo-cd · CWE-829	Critical9.9	—	0.5%	Oct 20, 2026
28Monitor	CVE-2026-113808No exploit	Stored XSS on SNS Enrollment Portalstormshield · stormshield network security · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 20, 2026
28Monitor	CVE-2026-113810No exploit	Stored XSS on SNS Enrollment Portalstormshield · stormshield network security · CWE-79 XSS	High7.0	—	0.0%	Oct 20, 2026
36Monitor	CVE-2026-97406No exploit	Authentication Bypass via Bearer Tokens to Unauthorized Credential Mintingxerj · console api · CWE-306 Pre-auth Auth bypass	Critical9.1	—	0.5%	Oct 20, 2026
19Monitor	CVE-2026-107692Proof of concept	War Thunder Account Impersonationgaijin entertainment · war thunder · CWE-319 Pre-auth Weak crypto	Medium4.8	—	0.1%	Oct 20, 2026
36Monitor	CVE-2026-112380No exploit	Missing authorization in the WhatsApp channel in Kiro Crewamazon · kiro crew · CWE-862 RCE Broken access control (IDOR)	Critical9.0	—	0.4%	Oct 20, 2026
28Monitor	CVE-2026-113718No exploit	virtualenv: Xonsh activation literals depend on the script decoding codecpypa · virtualenv · CWE-94 RCE	High7.1	—	0.2%	Oct 20, 2026
31Monitor	CVE-2026-113722No exploit	virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxpypa · virtualenv · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.2%	Oct 20, 2026
28Monitor	CVE-2026-113723No exploit	virtualenv: Bash prompt values can change meaning under older compatibility modespypa · virtualenv · CWE-78 RCE Command injection	High7.1	—	0.2%	Oct 20, 2026
31Monitor	CVE-2026-113725No exploit	virtualenv bash activate runs commands from an environment name with a backslash before $pypa · virtualenv · CWE-78 RCE Command injection	High7.8	—	0.2%	Oct 20, 2026
36Monitor	CVE-2026-113867No exploit	Stanza injection in XMPP chatmozilla · thunderbird · CWE-116 Pre-auth	Critical9.1	—	0.3%	Oct 20, 2026
32Monitor	CVE-2026-86409No exploit	stale SigV4 headers sent unintendedcurl · curl · CWE-201 Pre-auth	High8.1	—	1.0%	Oct 20, 2026
32Monitor	CVE-2026-86410No exploit	redirect to SFTP or SCP bypasses host verificationcurl · curl · CWE-297 Pre-auth Weak crypto	High8.1	—	0.7%	Oct 20, 2026
36Monitor	CVE-2026-86411No exploit	FTP connection reuse inherits client-certificatecurl · curl · CWE-488 Pre-auth	Critical9.1	—	0.4%	Oct 20, 2026
32Monitor	CVE-2026-86412No exploit	server-set cookie erases cookie jarcurl · curl · CWE-754 Pre-auth	High8.1	—	0.8%	Oct 20, 2026
36Monitor	CVE-2026-86413No exploit	Negotiate credentials sent to redirected origincurl · curl · CWE-201 Pre-auth	Critical9.1	—	0.7%	Oct 20, 2026
34Monitor	CVE-2012-20002No exploit	TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.phpjames charlesworth · tinymce thumbnail gallery · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Oct 20, 2026
34Monitor	CVE-2014-125133No exploit	NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.phpimithemes · nativechurch · CWE-22 Pre-auth Path traversal	High8.7	—	1.1%	Oct 20, 2026
34Monitor	CVE-2014-125134No exploit	ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.phpchurchope · churchope · CWE-22 Pre-auth Path traversal	High8.7	—	0.8%	Oct 20, 2026
34Monitor	CVE-2015-20123No exploit	Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.phpaspose · aspose doc exporter · CWE-22 Pre-auth Path traversal	High8.7	—	0.4%	Oct 20, 2026
34Monitor	CVE-2015-20124No exploit	Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.phpaspose · aspose importer & exporter · CWE-22 Pre-auth Path traversal	High8.7	—	0.4%	Oct 20, 2026
34Monitor	CVE-2015-20125No exploit	Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.phpaspose · aspose pdf exporter · CWE-22 Pre-auth Path traversal	High8.7	—	0.4%	Oct 20, 2026
35Monitor	CVE-2015-20128No exploit	FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspxfoosun · dotnetcms · CWE-89 Pre-auth SQL injection	High8.8	—	0.3%	Oct 20, 2026
34Monitor	CVE-2016-20100No exploit	Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-previewian howatson · memphis documents library · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Oct 20, 2026
36Monitor	CVE-2016-20101No exploit	Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.phppedro marcelo · issuu panel · CWE-98 Pre-auth	Critical9.2	—	0.3%	Oct 20, 2026
34Monitor	CVE-2016-20103No exploit	Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.phpcherry team · cherry plugin · CWE-22 Pre-auth Path traversal	High8.7	—	0.6%	Oct 20, 2026
34Monitor	CVE-2016-20104No exploit	EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.phpeyelock · nano nxt · CWE-22 Pre-auth Path traversal	High8.7	—	0.6%	Oct 20, 2026
32Monitor	CVE-2026-107928No exploit	info leak uploading over WebSockets with GnuTLScurl · curl · CWE-126 Pre-auth	High8.1	—	0.7%	Oct 20, 2026
32Monitor	CVE-2026-107929No exploit	local interface connection reuse mixupcurl · curl · CWE-488 Pre-auth	High8.1	—	0.6%	Oct 20, 2026
36Monitor	CVE-2026-10131No exploit	An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20totolink · totolink · CWE-78 RCE Command injection	Critical9.1	—	1.3%	Oct 20, 2026
36Monitor	CVE-2026-10132No exploit	A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-Btotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-10133No exploit	A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.totolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-10135No exploit	A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).totolink · totolink · CWE-78 RCE Command injection	Critical9.1	—	1.3%	Oct 20, 2026
36Monitor	CVE-2026-10136No exploit	A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20totolink · totolink · CWE-122 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-10137No exploit	A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2totolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-10138No exploit	A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421totolink · totolink · CWE-78 RCE Command injection	Critical9.1	—	1.4%	Oct 20, 2026
36Monitor	CVE-2026-10139No exploit	A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327totolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.6%	Oct 20, 2026
36Monitor	CVE-2026-10141No exploit	A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421totolink · totolink · CWE-347 Weak crypto	Critical9.1	—	0.2%	Oct 20, 2026
30Monitor	CVE-2026-111758No exploit	markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)markdown-it · markdown-it · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 20, 2026
34Monitor	CVE-2026-112407No exploit	Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applicationsaws · cicd-toolchain-for-serverless-applications · CWE-266	High8.7	—	0.4%	Oct 20, 2026
36Monitor	CVE-2026-112712No exploit	@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch@fastify/middie · @fastify/middie · CWE-436 Pre-auth	Critical9.1	—	0.3%	Oct 20, 2026
36Monitor	CVE-2026-28763No exploit	A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000Rtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.7%	Oct 20, 2026
36Monitor	CVE-2026-33568No exploit	A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.totolink · totolink · CWE-78 RCE Command injection	Critical9.1	—	1.0%	Oct 20, 2026
36Monitor	CVE-2026-35499No exploit	An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250totolink · totolink · CWE-78 RCE Command injection	Critical9.1	—	1.2%	Oct 20, 2026
36Monitor	CVE-2026-40615No exploit	A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X20totolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.7%	Oct 20, 2026
36Monitor	CVE-2026-40627No exploit	An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202totolink · totolink · CWE-78 RCE Command injection	Critical9.1	—	1.0%	Oct 20, 2026
36Monitor	CVE-2026-41222No exploit	A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-totolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.7%	Oct 20, 2026
36Monitor	CVE-2026-41223No exploit	A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.7%	Oct 20, 2026
36Monitor	CVE-2026-42019No exploit	Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.7%	Oct 20, 2026
36Monitor	CVE-2026-42020No exploit	Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.7%	Oct 20, 2026
36Monitor	CVE-2026-42021No exploit	Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink Xtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.4%	Oct 20, 2026
36Monitor	CVE-2026-42022No exploit	Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink Xtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.4%	Oct 20, 2026
36Monitor	CVE-2026-42023No exploit	Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink Xtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-42024No exploit	Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink Xtotolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-42025No exploit	Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s)totolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-42026No exploit	Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s)totolink · totolink · CWE-121 RCE Memory safety	Critical9.1	—	0.5%	Oct 20, 2026
36Monitor	CVE-2026-86414No exploit	leaking host credentials to HTTP proxycurl · curl · CWE-201 Pre-auth	Critical9.1	—	0.6%	Oct 20, 2026
30Monitor	CVE-2026-86415No exploit	auto client cert connection reuse mixupcurl · curl · CWE-201 Pre-auth	High7.5	—	0.4%	Oct 20, 2026
36Monitor	CVE-2026-87861No exploit	cross-origin reuse of a Negotiate connectioncurl · curl · CWE-201 Pre-auth	Critical9.1	—	0.6%	Oct 20, 2026
32Monitor	CVE-2026-87862No exploit	HSTS cache import drops longer-lived childcurl · curl · CWE-201 Pre-auth	High8.1	—	0.9%	Oct 20, 2026
32Monitor	CVE-2026-87863No exploit	HSTS response erases persisted entriescurl · curl · CWE-201 Pre-auth	High8.1	—	0.8%	Oct 20, 2026

CVE-2026-112942
31Monitor
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
HighCVSS 7.5No exploitEPSS 1%
- pre-auth RCE
- Command injection
vitejs · launch-editorOct 20, 2026
CVE-2026-91186
33Monitor
PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
HighCVSS 8.4No exploitEPSS 0%
- Memory safety
eclipse foundation · eclipse threadx - guixOct 20, 2026
CVE-2026-91189
28Monitor
GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
eclipse foundation · eclipse threadx - guixOct 20, 2026
CVE-2026-92162
28Monitor
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
HighCVSS 7.2Proof of conceptEPSS 0%
- Path traversal
- Local privilege escalation
flatpak · flatpakOct 20, 2026
CVE-2026-95168
31Monitor
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and
HighCVSS 7.8No exploitEPSS 0%
- RCE
Oct 20, 2026
CVE-2025-71436
28Monitor
Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
librdf · raptor rdf syntax libraryOct 20, 2026
CVE-2026-111764
30Monitor
A2A Java SDK has a fail-open default task authorization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
a2aproject · a2a-javaOct 20, 2026
CVE-2026-111765
30Monitor
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
a2aproject · a2a-javaOct 20, 2026
CVE-2026-112836
35Monitor
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
e4jvikwp · vikrentcarOct 20, 2026
CVE-2026-113605
34Monitor
Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
HighCVSS 8.6No exploitEPSS 0%
stirling-tools · stirling-pdfOct 20, 2026
CVE-2026-113606
28Monitor
Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
stirling-tools · stirling-pdfOct 20, 2026
CVE-2026-113607
28Monitor
Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jleyva · moodle-block_configurablereportsOct 20, 2026
CVE-2026-113613
36Monitor
FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Path traversal
flexget · flexgetOct 20, 2026
CVE-2026-113678
37Monitor
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
CriticalCVSS 9.4No exploitEPSS 0%
froxlor · froxlorOct 20, 2026
CVE-2026-113679
29Monitor
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
harfbuzz · harfbuzzOct 20, 2026
CVE-2026-113682
36Monitor
Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
networknt · light-4jOct 20, 2026
CVE-2026-113703
36Monitor
SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
giuseppe99barchetta · suggestarrOct 20, 2026
CVE-2026-86471
37Monitor
Apache CouchDB: Admin credentials leading to code execution as operating system user
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Command injection
apache software foundation · apache couchdbOct 20, 2026
CVE-2026-90797
30Monitor
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
apache software foundation · apache couchdbOct 20, 2026
CVE-2026-90800
32Monitor
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
apache software foundation · apache couchdbOct 20, 2026
CVE-2026-92843
34Monitor
Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · eclipse threadx - netx duoOct 20, 2026
CVE-2026-92853
34Monitor
Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · eclipse threadx - netx duoOct 20, 2026
CVE-2026-93475
37Monitor
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · eclipse threadx - netx duoOct 20, 2026
CVE-2026-94018
35Monitor
NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse threadx - netx duoOct 20, 2026
CVE-2026-94192
34Monitor
Module object deallocation can free a live ThreadX kernel object
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
eclipse foundation · eclipse threadxOct 20, 2026
CVE-2026-95107
28Monitor
Module object allocation size overflow corrupts the manager object pool
HighCVSS 7.0No exploitEPSS 0%
- Memory safety
eclipse foundation · eclipse threadxOct 20, 2026
CVE-2026-95109
34Monitor
Cortex-A7 module data validation checks only the first address of a caller-supplied range
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
- Memory safety
eclipse foundation · eclipse threadxOct 20, 2026
CVE-2026-113658
30Monitor
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- CSRF
- Denial of service
apostrophecms · apostropheOct 20, 2026
CVE-2026-28328
35Monitor
SolarWinds Observability Self-Hosted broken authorization schema
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
solarwinds · solarwinds observability self-hostedOct 20, 2026
CVE-2026-105772
36Monitor
Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
google · adk typescript (@google/adk)Oct 20, 2026
CVE-2026-111756
32Monitor
follow-redirects array-form headers bypass cross-origin credential stripping
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
follow-redirects · follow-redirectsOct 20, 2026
CVE-2026-113506
35Monitor
aaPanel File Manager common.py ExecShell os command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
Oct 20, 2026
CVE-2026-113666
28Monitor
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
apostrophecms · apostropheOct 20, 2026
CVE-2026-113672
39Monitor
Argo CD: A Jsonnet import can read files from the repo-server
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
argoproj · argo-cdOct 20, 2026
CVE-2026-113711
30Monitor
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apostrophecms · apostropheOct 20, 2026
CVE-2026-113802
38Monitor
Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
CriticalCVSS 9.3No exploitEPSS 3%
- pre-auth RCE
- Command injection
wavlink · wl-wn530be1-aOct 20, 2026
CVE-2026-100134
35Monitor
Acrobat for Edge | Out-of-bounds Write (CWE-787)
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
adobe · acrobat for edgeOct 20, 2026
CVE-2026-111767
34Monitor
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
modelcontextprotocol · typescript-sdkOct 20, 2026
CVE-2026-113708
39Monitor
Argo CD: A Kustomize remote ref can run commands in the repo-server
CriticalCVSS 9.9No exploitEPSS 0%
argoproj · argo-cdOct 20, 2026
CVE-2026-113709
39Monitor
Argo CD: A Kustomize Helm config home can run commands in the repo-server
CriticalCVSS 9.9No exploitEPSS 0%
argoproj · argo-cdOct 20, 2026
CVE-2026-113808
28Monitor
Stored XSS on SNS Enrollment Portal
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
stormshield · stormshield network securityOct 20, 2026
CVE-2026-113810
28Monitor
Stored XSS on SNS Enrollment Portal
HighCVSS 7.0No exploitEPSS 0%
- XSS
stormshield · stormshield network securityOct 20, 2026
CVE-2026-97406
36Monitor
Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
xerj · console apiOct 20, 2026
CVE-2026-107692
19Monitor
War Thunder Account Impersonation
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
gaijin entertainment · war thunderOct 20, 2026
CVE-2026-112380
36Monitor
Missing authorization in the WhatsApp channel in Kiro Crew
CriticalCVSS 9.0No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
amazon · kiro crewOct 20, 2026
CVE-2026-113718
28Monitor
virtualenv: Xonsh activation literals depend on the script decoding codec
HighCVSS 7.1No exploitEPSS 0%
- RCE
pypa · virtualenvOct 20, 2026
CVE-2026-113722
31Monitor
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
pypa · virtualenvOct 20, 2026
CVE-2026-113723
28Monitor
virtualenv: Bash prompt values can change meaning under older compatibility modes
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Command injection
pypa · virtualenvOct 20, 2026
CVE-2026-113725
31Monitor
virtualenv bash activate runs commands from an environment name with a backslash before $
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
pypa · virtualenvOct 20, 2026
CVE-2026-113867
36Monitor
Stanza injection in XMPP chat
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
mozilla · thunderbirdOct 20, 2026
CVE-2026-86409
32Monitor
stale SigV4 headers sent unintended
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-86410
32Monitor
redirect to SFTP or SCP bypasses host verification
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
curl · curlOct 20, 2026
CVE-2026-86411
36Monitor
FTP connection reuse inherits client-certificate
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-86412
32Monitor
server-set cookie erases cookie jar
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-86413
36Monitor
Negotiate credentials sent to redirected origin
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2012-20002
34Monitor
TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
james charlesworth · tinymce thumbnail galleryOct 20, 2026
CVE-2014-125133
34Monitor
NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
- Path traversal
imithemes · nativechurchOct 20, 2026
CVE-2014-125134
34Monitor
ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
churchope · churchopeOct 20, 2026
CVE-2015-20123
34Monitor
Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
aspose · aspose doc exporterOct 20, 2026
CVE-2015-20124
34Monitor
Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
aspose · aspose importer & exporterOct 20, 2026
CVE-2015-20125
34Monitor
Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
aspose · aspose pdf exporterOct 20, 2026
CVE-2015-20128
35Monitor
FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SQL injection
foosun · dotnetcmsOct 20, 2026
CVE-2016-20100
34Monitor
Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
ian howatson · memphis documents libraryOct 20, 2026
CVE-2016-20101
36Monitor
Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
pedro marcelo · issuu panelOct 20, 2026
CVE-2016-20103
34Monitor
Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
cherry team · cherry pluginOct 20, 2026
CVE-2016-20104
34Monitor
EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
eyelock · nano nxtOct 20, 2026
CVE-2026-107928
32Monitor
info leak uploading over WebSockets with GnuTLS
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-107929
32Monitor
local interface connection reuse mixup
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-10131
36Monitor
An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
totolink · totolinkOct 20, 2026
CVE-2026-10132
36Monitor
A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-10133
36Monitor
A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-10135
36Monitor
A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327).
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
totolink · totolinkOct 20, 2026
CVE-2026-10136
36Monitor
A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-10137
36Monitor
A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-10138
36Monitor
A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
totolink · totolinkOct 20, 2026
CVE-2026-10139
36Monitor
A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-10141
36Monitor
A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421
CriticalCVSS 9.1No exploitEPSS 0%
- Weak crypto
totolink · totolinkOct 20, 2026
CVE-2026-111758
30Monitor
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
markdown-it · markdown-itOct 20, 2026
CVE-2026-112407
34Monitor
Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications
HighCVSS 8.7No exploitEPSS 0%
aws · cicd-toolchain-for-serverless-applicationsOct 20, 2026
CVE-2026-112712
36Monitor
@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
@fastify/middie · @fastify/middieOct 20, 2026
CVE-2026-28763
36Monitor
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-33568
36Monitor
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
totolink · totolinkOct 20, 2026
CVE-2026-35499
36Monitor
An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
totolink · totolinkOct 20, 2026
CVE-2026-40615
36Monitor
A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X20
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-40627
36Monitor
An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
totolink · totolinkOct 20, 2026
CVE-2026-41222
36Monitor
A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-41223
36Monitor
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-G
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42019
36Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42020
36Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42021
36Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42022
36Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42023
36Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42024
36Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42025
36Monitor
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s)
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-42026
36Monitor
Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s)
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Memory safety
totolink · totolinkOct 20, 2026
CVE-2026-86414
36Monitor
leaking host credentials to HTTP proxy
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-86415
30Monitor
auto client cert connection reuse mixup
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-87861
36Monitor
cross-origin reuse of a Negotiate connection
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-87862
32Monitor
HSTS cache import drops longer-lived child
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026
CVE-2026-87863
32Monitor
HSTS response erases persisted entries
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
curl · curlOct 20, 2026