By publication date

Exploited and new serious CVEs: October 2026

8,746 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 64 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-114055No exploit	vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargsvllm · vllm · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-114059No exploit	ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorizationarcadedata · arcadedb · CWE-863 RCE Broken access control (IDOR)	High7.7	—	0.6%	Oct 21, 2026
34Monitor	CVE-2026-114063No exploit	SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windowssveltejs · kit · CWE-22 Pre-auth Path traversal	High8.7	—	0.4%	Oct 21, 2026
28Monitor	CVE-2026-114065No exploit	Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholderstriggerdotdev · trigger.dev · CWE-89 SQL injection	High7.1	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-114066No exploit	Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpointstriggerdotdev · trigger.dev · CWE-639 Broken access control (IDOR)	High7.2	—	0.2%	Oct 21, 2026
28Monitor	CVE-2026-114067No exploit	Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Routetriggerdotdev · trigger.dev · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-114068No exploit	Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpointtriggerdotdev · trigger.dev · CWE-639 Broken access control (IDOR)	High7.2	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-114069No exploit	Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpointtriggerdotdev · trigger.dev · CWE-269	High8.6	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-114078No exploit	Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookuptriggerdotdev · trigger.dev · CWE-639 Broken access control (IDOR)	High7.2	—	0.4%	Oct 21, 2026
33Monitor	CVE-2026-114081No exploit	Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Nametriggerdotdev · trigger.dev · CWE-89 SQL injection	High8.3	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-114082No exploit	Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentialstriggerdotdev · trigger.dev · CWE-862 Broken access control (IDOR)	High7.2	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-114083No exploit	Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpointstriggerdotdev · trigger.dev · CWE-22 Path traversal	High8.6	—	0.4%	Oct 21, 2026
33Monitor	CVE-2026-114084No exploit	Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs APItriggerdotdev · trigger.dev · CWE-89 SQL injection	High8.3	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-114085No exploit	Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload APItriggerdotdev · trigger.dev · CWE-306 Auth bypass	High8.8	—	0.1%	Oct 21, 2026
36Monitor	CVE-2026-114087No exploit	Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretstriggerdotdev · trigger.dev · CWE-653 Pre-auth Auth bypass Hard-coded credentials	Critical9.2	—	0.5%	Oct 21, 2026
33Monitor	CVE-2026-114088No exploit	Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IOtriggerdotdev · trigger.dev · CWE-798 Pre-auth Auth bypass Hard-coded credentials	High8.3	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-114089No exploit	Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeovertriggerdotdev · trigger.dev · CWE-352 Pre-auth CSRF	High8.7	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-114090No exploit	Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Servertrigger.dev · cli-v3 · CWE-306 Pre-auth Auth bypass	High7.6	—	0.2%	Oct 21, 2026
33Monitor	CVE-2026-114092No exploit	Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Actiontriggerdotdev · trigger.dev · CWE-306 Pre-auth Auth bypass	High8.3	—	0.5%	Oct 21, 2026
34Monitor	CVE-2026-114094No exploit	Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter pathsjelmer · dulwich · CWE-22 pre-auth RCE Path traversal	High8.7	—	0.9%	Oct 21, 2026
28Monitor	CVE-2026-114095No exploit	Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_objectjelmer · dulwich · CWE-835 Pre-auth Denial of service	High7.1	—	0.3%	Oct 21, 2026
29Monitor	CVE-2026-114096No exploit	Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout pathsjelmer · dulwich · CWE-59	High7.3	—	0.1%	Oct 21, 2026
29Monitor	CVE-2026-114097No exploit	Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filterjelmer · dulwich · CWE-22 Path traversal	High7.3	—	0.1%	Oct 21, 2026
29Monitor	CVE-2026-114098No exploit	Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinksjelmer · dulwich · CWE-22 Path traversal	High7.3	—	0.1%	Oct 21, 2026
25Monitor	CVE-2026-114101Proof of concept	Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypasscorazawaf · coraza · CWE-20 Pre-auth	Medium6.3	—	0.2%	Oct 21, 2026
34Monitor	CVE-2026-114102Proof of concept	adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Eventcthackers · adm-zip · CWE-248 Pre-auth	High8.7	—	0.4%	Oct 21, 2026
32Monitor	CVE-2026-114104No exploit	adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypasscthackers · adm-zip · CWE-436 Pre-auth	High8.2	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-114106No exploit	HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_pathhkuds · vibe-trading · CWE-22 Pre-auth Path traversal	High8.7	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-114107No exploit	HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunToolhkuds · vibe-trading · CWE-1427 pre-auth RCE SSRF	High8.7	—	0.5%	Oct 21, 2026
37Monitor	CVE-2026-114108No exploit	HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCEhkuds · vibe-trading · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.5%	Oct 21, 2026
34Monitor	CVE-2026-114109No exploit	uv before 0.11.15 Arbitrary File Write via Entry Point Namesastral-sh · uv · CWE-22 Pre-auth Path traversal	High8.7	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-114110No exploit	Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entriesastral-sh · uv · CWE-23 Pre-auth Path traversal	High8.7	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-114111No exploit	Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerabilitylovell · sharp · CWE-416 RCE Memory safety	High8.9	—	0.1%	Oct 21, 2026
35Monitor	CVE-2026-114112No exploit	Sharp before 0.35.4 RCE via bundled libheif AVIF decodinglovell · sharp · CWE-122 RCE Memory safety	High8.9	—	0.2%	Oct 21, 2026
33Monitor	CVE-2026-114113No exploit	Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoderslovell · sharp · CWE-1395	High8.4	—	0.1%	Oct 21, 2026
32Monitor	CVE-2026-114117No exploit	Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value \| K in Ternary Branchesvyperlang · vyper · CWE-682 Pre-auth	High8.2	—	0.2%	Oct 21, 2026
37Monitor	CVE-2026-114119No exploit	Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credentialbest practice software · bp premier · CWE-798 Pre-auth Hard-coded credentials	Critical9.3	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-114197No exploit	Deserialization of untrusted data in capamandiant flare · capa · CWE-502 RCE Deserialization	High8.7	—	0.1%	Oct 21, 2026
34Monitor	CVE-2026-114198No exploit	Deserialization of untrusted data in flossmandiant flare · floss · CWE-502 RCE Deserialization	High8.7	—	0.1%	Oct 21, 2026
37Monitor	CVE-2026-113744No exploit	Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflowtenda · ac19 · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.6%	Oct 21, 2026
35Monitor	CVE-2026-82814No exploit	Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injectionsmub · duplicator – backups & migration plugin – cloud backups, scheduled backups, & more · CWE-502 pre-auth RCE Deserialization	High8.8	—	0.7%	Oct 21, 2026
28Monitor	CVE-2026-82819No exploit	Universal Naming Convention (UNC) Path Injection in Cerberus FTP Servercerberus · cerberus ftp server · CWE-40	High7.1	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-102499No exploit	Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Actionunknown · modern events calendar lite · CWE-89 SQL injection	High7.7	—	0.3%	Oct 21, 2026
32Monitor	CVE-2026-105262No exploit	Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translationunknown · falang multilanguage for wordpress · CWE-79 XSS	High8.0	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-107127No exploit	Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRFunknown · uncanny toolkit for learndash · CWE-352 Pre-auth CSRF	High7.5	—	0.1%	Oct 21, 2026
32Monitor	CVE-2026-107237No exploit	Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_liveunknown · backup and staging by wp time capsule · CWE-862 Broken access control (IDOR)	High8.2	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-107506No exploit	Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Settingunknown · simple banner · CWE-269	High7.5	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-109147No exploit	WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameterunknown · wp booking system · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
32Monitor	CVE-2026-110523No exploit	WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnectunknown · wp user manager · CWE-269 Pre-auth	High8.1	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-111574No exploit	Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metaboxunknown · redirection for contact form 7 · CWE-79 Pre-auth XSS	High7.5	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-111948No exploit	Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actionsunknown · user profile builder · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-111949No exploit	miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebindingunknown · miniorange 2fa · CWE-287 Auth bypass	High7.5	—	0.2%	Oct 21, 2026
39Monitor	CVE-2026-71195No exploit	In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.openstack · manila · CWE-863 Broken access control (IDOR)	Critical9.9	—	0.4%	Oct 21, 2026
28Monitor	CVE-2026-79627No exploit	Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypassunknown · advanced file manager · CWE-79 XSS	High7.1	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-85642No exploit	Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoSunknown · formidable forms · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-88784No exploit	Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewritingunknown · translate wordpress with weglot 2.0 · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Oct 21, 2026
34Monitor	CVE-2026-92997No exploit	Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameterunknown · click n chat (chat widget integration) · CWE-89 Pre-auth SQL injection	High8.6	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-92998No exploit	Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parametersunknown · click n chat (chat widget integration) · CWE-89 Pre-auth SQL injection	High8.6	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-107435No exploit	WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerabilitywp chill · strong testimonials · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 21, 2026
28Monitor	CVE-2026-110899Proof of concept	WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerabilitykevin stover · ninja forms · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
34Monitor	CVE-2026-111074No exploit	JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()eclipse foundation · eclipse openj9 · CWE-190 Pre-auth Memory safety	High8.7	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-111075No exploit	JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserializationeclipse foundation · eclipse openj9 · CWE-125 Pre-auth Deserialization Memory safety	High8.7	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-110938No exploit	JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsingeclipse foundation · eclipse openj9 · CWE-20 Pre-auth	High8.7	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-70386No exploit	OnePlus OxygenOS improper neutralization of special elements vulnerabilityoneplus · oxygenos · CWE-78 RCE Command injection	High8.5	—	1.3%	Oct 21, 2026
33Monitor	CVE-2026-70387No exploit	OnePlus OxygenOS exposed dangerous method vulnerabilityoneplus · oxygenos · CWE-749 RCE Local privilege escalation	High8.4	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-85683No exploit	Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URLunknown · jane menu · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-97206Proof of concept	DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.nlnet labs · unbound · CWE-416 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-110369No exploit	WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerabilitygs plugins · wordpress team members – gs plugins · CWE-502 Deserialization	High8.8	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-110370No exploit	WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerabilitygs plugins · gs pins for pinterest · CWE-502 Deserialization	High8.8	—	0.4%	Oct 21, 2026
28Monitor	CVE-2026-110884No exploit	WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilitygeekontheroad · live summary for gravity forms · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-41114No exploit	Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driverapache software foundation · apache iotdb jdbc driver · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
39Monitor	CVE-2026-58663No exploit	Apache IoTDB: Auth Bypass in pipeTransfer() interfaceapache software foundation · apache iotdb · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 21, 2026
36Monitor	CVE-2026-87095No exploit	Sensitive information disclosure and manipulation due to improper authorization checks.acronis · acronis cyber infrastructure · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.2%	Oct 21, 2026
36Monitor	CVE-2026-48830No exploit	Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsapache software foundation · apache brpc · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-54425No exploit	Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decodingapache software foundation · apache brpc · CWE-674 Pre-auth Denial of service	High7.5	—	0.6%	Oct 21, 2026
30Monitor	CVE-2026-54426No exploit	Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parserapache software foundation · apache brpc · CWE-674 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-54427No exploit	Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parserapache software foundation · apache brpc · CWE-674 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-56386No exploit	Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parserapache software foundation · apache brpc · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.7%	Oct 21, 2026
30Monitor	CVE-2026-56387No exploit	Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parserapache software foundation · apache brpc · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
36Monitor	CVE-2026-56388No exploit	Apache bRPC: Out-of-Bounds Write in Redis Command Parserapache software foundation · apache brpc · CWE-252 Pre-auth	Critical9.1	—	0.9%	Oct 21, 2026
30Monitor	CVE-2026-58064No exploit	Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocationapache software foundation · apache brpc · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
35Monitor	CVE-2026-59229No exploit	Apache IoTDB: Legacy Pipe Privilege Escalationapache software foundation · apache iotdb · CWE-798 Hard-coded credentials	High8.8	—	0.4%	Oct 21, 2026
39Monitor	CVE-2026-59562No exploit	Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPCapache software foundation · apache iotdb · CWE-306 pre-auth RCE Auth bypass Path traversal	Critical9.8	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-61902No exploit	Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limitsapache software foundation · apache brpc · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-61916No exploit	Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platformsapache software foundation · apache brpc · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-74755No exploit	Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Serviceapache software foundation · apache brpc · CWE-191 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-74757No exploit	Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Countapache software foundation · apache brpc · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Oct 21, 2026
30Monitor	CVE-2026-74758No exploit	Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handlingapache software foundation · apache brpc · CWE-416 Pre-auth Memory safety Denial of service	High7.5	—	0.6%	Oct 21, 2026
30Monitor	CVE-2026-78048No exploit	Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoderapache software foundation · apache brpc · CWE-617 Pre-auth Denial of service	High7.5	—	0.6%	Oct 21, 2026
30Monitor	CVE-2026-78058No exploit	Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Pathapache software foundation · apache brpc · CWE-400 Pre-auth Denial of service	High7.5	—	0.8%	Oct 21, 2026
30Monitor	CVE-2026-78066No exploit	Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizesapache software foundation · apache brpc · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
36Monitor	CVE-2026-78334No exploit	Apache bRPC: Missing Authentication for Streaming RPC Framesapache software foundation · apache brpc · CWE-306 Pre-auth Auth bypass	Critical9.1	—	0.6%	Oct 21, 2026
30Monitor	CVE-2026-79704No exploit	Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handlingapache software foundation · apache brpc · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-80463No exploit	Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassemblyapache software foundation · apache brpc · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-81755No exploit	Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Requestapache software foundation · apache brpc · CWE-400 Pre-auth Denial of service	High7.5	—	0.7%	Oct 21, 2026
34Monitor	CVE-2026-114387No exploit	Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Componentsshopperlabs · shopper · CWE-862 Broken access control (IDOR)	High8.7	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-114391No exploit	ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methodseasysoft · zentaopms · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Oct 21, 2026
28Monitor	CVE-2026-114396No exploit	Trudesk through 1.2.11 MongoDB $where Injection via tickets search APItrudesk project · trudesk · CWE-943 SQL injection	High7.1	—	0.5%	Oct 21, 2026
33Monitor	CVE-2026-114397No exploit	Trudesk through 1.2.11 Missing Authentication on Debug Routestrudesk project · trudesk · CWE-1188 Pre-auth Auth bypass	High8.3	—	0.6%	Oct 21, 2026
28Monitor	CVE-2026-114399No exploit	Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore APItrudesk project · trudesk · CWE-22 Path traversal	High7.0	—	0.5%	Oct 21, 2026

CVE-2026-114055
34Monitor
vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
vllm · vllmOct 21, 2026
CVE-2026-114059
30Monitor
ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
arcadedata · arcadedbOct 21, 2026
CVE-2026-114063
34Monitor
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
sveltejs · kitOct 21, 2026
CVE-2026-114065
28Monitor
Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114066
28Monitor
Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114067
28Monitor
Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114068
28Monitor
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114069
34Monitor
Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
HighCVSS 8.6No exploitEPSS 0%
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114078
28Monitor
Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114081
33Monitor
Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name
HighCVSS 8.3No exploitEPSS 0%
- SQL injection
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114082
28Monitor
Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114083
34Monitor
Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114084
33Monitor
Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
HighCVSS 8.3No exploitEPSS 0%
- SQL injection
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114085
35Monitor
Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114087
36Monitor
Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114088
33Monitor
Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114089
34Monitor
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- CSRF
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114090
30Monitor
Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
trigger.dev · cli-v3Oct 21, 2026
CVE-2026-114092
33Monitor
Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
triggerdotdev · trigger.devOct 21, 2026
CVE-2026-114094
34Monitor
Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Path traversal
jelmer · dulwichOct 21, 2026
CVE-2026-114095
28Monitor
Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
jelmer · dulwichOct 21, 2026
CVE-2026-114096
29Monitor
Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
HighCVSS 7.3No exploitEPSS 0%
jelmer · dulwichOct 21, 2026
CVE-2026-114097
29Monitor
Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
jelmer · dulwichOct 21, 2026
CVE-2026-114098
29Monitor
Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
jelmer · dulwichOct 21, 2026
CVE-2026-114101
25Monitor
Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
corazawaf · corazaOct 21, 2026
CVE-2026-114102
34Monitor
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
cthackers · adm-zipOct 21, 2026
CVE-2026-114104
32Monitor
adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
cthackers · adm-zipOct 21, 2026
CVE-2026-114106
34Monitor
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
hkuds · vibe-tradingOct 21, 2026
CVE-2026-114107
34Monitor
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- SSRF
hkuds · vibe-tradingOct 21, 2026
CVE-2026-114108
37Monitor
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
hkuds · vibe-tradingOct 21, 2026
CVE-2026-114109
34Monitor
uv before 0.11.15 Arbitrary File Write via Entry Point Names
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
astral-sh · uvOct 21, 2026
CVE-2026-114110
34Monitor
Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
astral-sh · uvOct 21, 2026
CVE-2026-114111
35Monitor
Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
HighCVSS 8.9No exploitEPSS 0%
- RCE
- Memory safety
lovell · sharpOct 21, 2026
CVE-2026-114112
35Monitor
Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
HighCVSS 8.9No exploitEPSS 0%
- RCE
- Memory safety
lovell · sharpOct 21, 2026
CVE-2026-114113
33Monitor
Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders
HighCVSS 8.4No exploitEPSS 0%
lovell · sharpOct 21, 2026
CVE-2026-114117
32Monitor
Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
vyperlang · vyperOct 21, 2026
CVE-2026-114119
37Monitor
Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
best practice software · bp premierOct 21, 2026
CVE-2026-114197
34Monitor
Deserialization of untrusted data in capa
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Deserialization
mandiant flare · capaOct 21, 2026
CVE-2026-114198
34Monitor
Deserialization of untrusted data in floss
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Deserialization
mandiant flare · flossOct 21, 2026
CVE-2026-113744
37Monitor
Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
tenda · ac19Oct 21, 2026
CVE-2026-82814
35Monitor
Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
smub · duplicator – backups & migration plugin – cloud backups, scheduled backups, & moreOct 21, 2026
CVE-2026-82819
28Monitor
Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server
HighCVSS 7.1No exploitEPSS 0%
cerberus · cerberus ftp serverOct 21, 2026
CVE-2026-102499
30Monitor
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
HighCVSS 7.7No exploitEPSS 0%
- SQL injection
unknown · modern events calendar liteOct 21, 2026
CVE-2026-105262
32Monitor
Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
HighCVSS 8.0No exploitEPSS 0%
- XSS
unknown · falang multilanguage for wordpressOct 21, 2026
CVE-2026-107127
30Monitor
Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- CSRF
unknown · uncanny toolkit for learndashOct 21, 2026
CVE-2026-107237
32Monitor
Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live
HighCVSS 8.2No exploitEPSS 0%
- Broken access control (IDOR)
unknown · backup and staging by wp time capsuleOct 21, 2026
CVE-2026-107506
30Monitor
Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
HighCVSS 7.5No exploitEPSS 0%
unknown · simple bannerOct 21, 2026
CVE-2026-109147
28Monitor
WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · wp booking systemOct 21, 2026
CVE-2026-110523
32Monitor
WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
unknown · wp user managerOct 21, 2026
CVE-2026-111574
30Monitor
Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · redirection for contact form 7Oct 21, 2026
CVE-2026-111948
28Monitor
Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · user profile builderOct 21, 2026
CVE-2026-111949
30Monitor
miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · miniorange 2faOct 21, 2026
CVE-2026-71195
39Monitor
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share.
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
openstack · manilaOct 21, 2026
CVE-2026-79627
28Monitor
Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
HighCVSS 7.1No exploitEPSS 0%
- XSS
unknown · advanced file managerOct 21, 2026
CVE-2026-85642
30Monitor
Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unknown · formidable formsOct 21, 2026
CVE-2026-88784
30Monitor
Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · translate wordpress with weglot 2.0Oct 21, 2026
CVE-2026-92997
34Monitor
Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · click n chat (chat widget integration)Oct 21, 2026
CVE-2026-92998
34Monitor
Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · click n chat (chat widget integration)Oct 21, 2026
CVE-2026-107435
28Monitor
WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp chill · strong testimonialsOct 21, 2026
CVE-2026-110899
28Monitor
WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
kevin stover · ninja formsOct 21, 2026
CVE-2026-111074
34Monitor
JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · eclipse openj9Oct 21, 2026
CVE-2026-111075
34Monitor
JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
- Memory safety
eclipse foundation · eclipse openj9Oct 21, 2026
CVE-2026-110938
34Monitor
JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse openj9Oct 21, 2026
CVE-2026-70386
34Monitor
OnePlus OxygenOS improper neutralization of special elements vulnerability
HighCVSS 8.5No exploitEPSS 1%
- RCE
- Command injection
oneplus · oxygenosOct 21, 2026
CVE-2026-70387
33Monitor
OnePlus OxygenOS exposed dangerous method vulnerability
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Local privilege escalation
oneplus · oxygenosOct 21, 2026
CVE-2026-85683
35Monitor
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · jane menuOct 21, 2026
CVE-2026-97206
30Monitor
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
nlnet labs · unboundOct 21, 2026
CVE-2026-110369
35Monitor
WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
gs plugins · wordpress team members – gs pluginsOct 21, 2026
CVE-2026-110370
35Monitor
WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
gs plugins · gs pins for pinterestOct 21, 2026
CVE-2026-110884
28Monitor
WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
geekontheroad · live summary for gravity formsOct 21, 2026
CVE-2026-41114
30Monitor
Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache iotdb jdbc driverOct 21, 2026
CVE-2026-58663
39Monitor
Apache IoTDB: Auth Bypass in pipeTransfer() interface
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache iotdbOct 21, 2026
CVE-2026-87095
36Monitor
Sensitive information disclosure and manipulation due to improper authorization checks.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
acronis · acronis cyber infrastructureOct 21, 2026
CVE-2026-48830
36Monitor
Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache brpcOct 21, 2026
CVE-2026-54425
30Monitor
Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-54426
30Monitor
Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-54427
30Monitor
Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-56386
30Monitor
Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-56387
30Monitor
Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-56388
36Monitor
Apache bRPC: Out-of-Bounds Write in Redis Command Parser
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache software foundation · apache brpcOct 21, 2026
CVE-2026-58064
30Monitor
Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-59229
35Monitor
Apache IoTDB: Legacy Pipe Privilege Escalation
HighCVSS 8.8No exploitEPSS 0%
- Hard-coded credentials
apache software foundation · apache iotdbOct 21, 2026
CVE-2026-59562
39Monitor
Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- Path traversal
apache software foundation · apache iotdbOct 21, 2026
CVE-2026-61902
30Monitor
Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-61916
30Monitor
Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-74755
30Monitor
Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-74757
30Monitor
Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-74758
30Monitor
Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-78048
30Monitor
Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-78058
30Monitor
Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-78066
30Monitor
Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-78334
36Monitor
Apache bRPC: Missing Authentication for Streaming RPC Frames
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache brpcOct 21, 2026
CVE-2026-79704
30Monitor
Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-80463
30Monitor
Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-81755
30Monitor
Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-114387
34Monitor
Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
shopperlabs · shopperOct 21, 2026
CVE-2026-114391
28Monitor
ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
easysoft · zentaopmsOct 21, 2026
CVE-2026-114396
28Monitor
Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
trudesk project · trudeskOct 21, 2026
CVE-2026-114397
33Monitor
Trudesk through 1.2.11 Missing Authentication on Debug Routes
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
trudesk project · trudeskOct 21, 2026
CVE-2026-114399
28Monitor
Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
trudesk project · trudeskOct 21, 2026