By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 65 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-114399No exploit	Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore APItrudesk project · trudesk · CWE-22 Path traversal	High7.0	—	0.5%	Oct 21, 2026
32Monitor	CVE-2026-114400No exploit	Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploadstrudesk project · trudesk · CWE-552 Pre-auth Auth bypass	High8.2	—	0.4%	Oct 21, 2026
36Monitor	CVE-2026-114403No exploit	PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::loadphpoffice · phppresentation · CWE-502 Pre-auth Deserialization	Critical9.2	—	0.7%	Oct 21, 2026
34Monitor	CVE-2026-114405No exploit	Denial of Service via Malformed VATP Packet in Velneo vServervelneo · vserver · CWE-129 Pre-auth	High8.7	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-19630No exploit	Amplified resource exhaustion in inbound message processingisc · bind 9 · CWE-407 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-82210No exploit	Apache bRPC: Remote denial of service (crash) via malformed stream feedback framesapache software foundation · apache brpc · CWE-617 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-82230No exploit	Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parserapache software foundation · apache brpc · CWE-674 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-82231No exploit	Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift clientapache software foundation · apache brpc · CWE-248 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-82425No exploit	Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Serviceapache software foundation · apache brpc · CWE-617 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-82942No exploit	Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Serviceapache software foundation · apache brpc · CWE-362 Pre-auth Race condition Denial of service	High7.5	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-84747No exploit	Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segmentsapache software foundation · apache brpc · CWE-436 Pre-auth	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-84748No exploit	Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configurationapache software foundation · apache brpc · CWE-285 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-86146No exploit	Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsingapache software foundation · apache brpc · CWE-444 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-86147No exploit	Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprofapache software foundation · apache brpc · CWE-73 Pre-auth Path traversal Denial of service	High7.5	—	0.5%	Oct 21, 2026
36Monitor	CVE-2026-86249No exploit	Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.authapache software foundation · apache brpc · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.5%	Oct 21, 2026
32Monitor	CVE-2026-94300Proof of concept	Concurrent GSS-TSIG messages corrupt memoryisc · bind 9 · CWE-362 pre-auth RCE Race condition	High8.1	—	0.9%	Oct 21, 2026
30Monitor	CVE-2026-96888No exploit	Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimizationisc · bind 9 · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-97313No exploit	Specific RPZ configurations and query patterns may result in an unexpected exitisc · bind 9 · CWE-617 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
29Monitor	CVE-2025-0326No exploit	Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Accesswso2 · wso2 identity server · CWE-613 Pre-auth	High7.4	—	0.2%	Oct 21, 2026
28Monitor	CVE-2026-104948No exploit	WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the builenterprisedb · warehousepg · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 21, 2026
96Now	CVE-2026-109618Weaponized	RCE via OOM corruptionphp · php · CWE-416 pre-auth RCE Memory safety	Critical9.2	KEV	99.9%	Oct 21, 2026
96Now	CVE-2026-109619Weaponized	RCE via stale global statephp · php · CWE-416 pre-auth RCE Memory safety	Critical9.2	KEV	99.9%	Oct 21, 2026
35Monitor	CVE-2023-7356No exploit	Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUIDlinux · linux Pre-auth	High8.8	—	0.2%	Oct 21, 2026
40Plan	CVE-2026-111832No exploit	WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerabilitywp mailster · wp mailster · CWE-434 Pre-auth File upload	Critical10.0	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-111833No exploit	WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerabilitybold grid · weforms · CWE-22 Pre-auth Path traversal Denial of service	High7.5	—	0.4%	Oct 21, 2026
39Monitor	CVE-2026-111834No exploit	WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerabilitykitae park · mang board wp · CWE-434 File upload	Critical9.9	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-111838No exploit	WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerabilitythemehunk · themehunk customizer · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
28Monitor	CVE-2026-111840No exploit	WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerabilityvideowhisper.com · paid videochat turnkey site · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
28Monitor	CVE-2026-111848No exploit	WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerabilitydylan kuhn · geo mashup · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
37Monitor	CVE-2026-111852No exploit	WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerabilitywpdreams · ajax search lite · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-112221No exploit	WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerabilitybrainstorm force · surecart · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 21, 2026
35Monitor	CVE-2026-113779No exploit	pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permissionpfrest · pfsense-pkg-restapi · CWE-502 Deserialization	High8.8	—	0.4%	Oct 21, 2026
31Monitor	CVE-2026-98869No exploit	bpf: Infer zext_dst based on static register liveness analysislinux · linux	High7.8	—	0.1%	Oct 21, 2026
30Monitor	CVE-2026-102483No exploit	Reachable Assertion in ntpsecntpsec · ntpsec · CWE-617 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-102486No exploit	Out-of-bounds Read in ntpsecntpsec · ntpsec · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 21, 2026
37Monitor	CVE-2026-113788No exploit	Lagoon core ssh service vulnerable to remote code executionuselagoon · lagoon · CWE-78 RCE Command injection	Critical9.4	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-114463No exploit	The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-nous research · hermes agent · CWE-863 Broken access control (IDOR)	High7.5	—	0.6%	Oct 21, 2026
30Monitor	CVE-2026-114476No exploit	Incorrect Authorization in hMailServerprogressive robot ltd · hmailserver · CWE-863 Broken access control (IDOR)	High7.5	—	0.2%	Oct 21, 2026
32Monitor	CVE-2026-114489No exploit	Missing Authorization in hMailServerprogressive robot ltd · hmailserver · CWE-862 Broken access control (IDOR)	High8.1	—	0.2%	Oct 21, 2026
31Monitor	CVE-2026-114490No exploit	Incorrect Authorization in hMailServerprogressive robot ltd · hmailserver · CWE-863 Broken access control (IDOR)	High7.8	—	0.1%	Oct 21, 2026
30Monitor	CVE-2026-114123No exploit	D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internetdynamics365ninja · d365fo-mcp-server · CWE-306 Pre-auth Auth bypass	High7.5	—	0.4%	Oct 21, 2026
36Monitor	CVE-2026-20043No exploit	Multiple Cisco Products Snort 3 Software Hardening Release: October 2026cisco · cisco cyber vision · CWE-787 Pre-auth Memory safety	Critical9.0	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-20236No exploit	Multiple Cisco Products Snort 3 Software Hardening Release: October 2026cisco · cisco cyber vision · CWE-682 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
31Monitor	CVE-2026-20291No exploit	Multiple Cisco Products Snort 3 Software Hardening Release: October 2026cisco · cisco cyber vision · CWE-269 Local privilege escalation	High7.8	—	0.1%	Oct 21, 2026
30Monitor	CVE-2026-20356No exploit	Multiple Cisco Products Snort 3 Software Hardening Release: October 2026cisco · cisco cyber vision · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
39Monitor	CVE-2026-76466No exploit	Cisco Expressway Series Remote Code Execution Vulnerabilitycisco · cisco telepresence video communication server (vcs) expressway · CWE-798 pre-auth RCE Hard-coded credentials	Critical9.8	—	0.4%	Oct 21, 2026
39Monitor	CVE-2026-76473No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.cisco · cisco emergency responder · CWE-74 Pre-auth	Critical9.8	—	0.5%	Oct 21, 2026
39Monitor	CVE-2026-76474No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilitiescisco · cisco emergency responder · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 21, 2026
37Monitor	CVE-2026-76475No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilitiescisco · cisco emergency responder · CWE-79 Pre-auth XSS	Critical9.3	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-76476No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilitiescisco · cisco emergency responder · CWE-20	High8.8	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-76477No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilitiescisco · cisco emergency responder · CWE-89 SQL injection	High8.8	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-76478No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilitiescisco · cisco emergency responder · CWE-284 Broken access control (IDOR)	High8.8	—	0.1%	Oct 21, 2026
31Monitor	CVE-2026-76479No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilitiescisco · cisco emergency responder · CWE-22 Path traversal	High7.8	—	0.1%	Oct 21, 2026
30Monitor	CVE-2026-76481No exploit	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilitiescisco · cisco emergency responder · CWE-703 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-76490No exploit	Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilitiescisco · cisco telepresence video communication server (vcs) expressway · CWE-787 Pre-auth Memory safety Denial of service	High8.6	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-76491No exploit	Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilitiescisco · cisco telepresence video communication server (vcs) expressway · CWE-617 Pre-auth Denial of service	High7.5	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-76492No exploit	Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilitiescisco · cisco telepresence video communication server (vcs) expressway · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-76493No exploit	Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilitiescisco · cisco telepresence video communication server (vcs) expressway · CWE-248 Pre-auth Denial of service	High7.5	—	0.3%	Oct 21, 2026
31Monitor	CVE-2026-76494No exploit	Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilitiescisco · cisco telepresence video communication server (vcs) expressway · CWE-94 RCE	High7.8	—	0.2%	Oct 21, 2026
31Monitor	CVE-2026-76495No exploit	Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilitiescisco · cisco telepresence video communication server (vcs) expressway · CWE-732	High7.8	—	0.1%	Oct 21, 2026
28Monitor	CVE-2026-76496No exploit	Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilitiescisco · cisco telepresence video communication server (vcs) expressway · CWE-59	High7.0	—	0.1%	Oct 21, 2026
30Monitor	CVE-2026-76505No exploit	Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerabilitycisco · cisco ios xr software · CWE-20 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
31Monitor	CVE-2026-76524No exploit	Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerabilitycisco · cisco open source snort3 · CWE-306 RCE Auth bypass Local privilege escalation	High7.8	—	0.1%	Oct 21, 2026
36Monitor	CVE-2026-105869No exploit	Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleapache software foundation · apache pulsar · CWE-347 Pre-auth Weak crypto	Critical9.2	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-110744No exploit	Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-widered hat · multicluster global hub · CWE-269	High7.2	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-111183No exploit	GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerabilitygstreamer · gstreamer · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	0.7%	Oct 21, 2026
31Monitor	CVE-2026-111184No exploit	NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerabilitynomachine · nomachine · CWE-732 RCE Local privilege escalation	High7.8	—	0.1%	Oct 21, 2026
34Monitor	CVE-2026-114125No exploit	Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesstorybookjs · storybook · CWE-94 pre-auth RCE	High8.6	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-114126No exploit	Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story filesstorybookjs · storybook · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Oct 21, 2026
28Monitor	CVE-2026-114492No exploit	gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpointflipped-aurora · gin-vue-admin · CWE-22 Path traversal	High7.0	—	0.5%	Oct 21, 2026
36Monitor	CVE-2026-114493No exploit	LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirectslocalai · localai · CWE-918 Pre-auth SSRF	Critical9.2	—	0.3%	Oct 21, 2026
36Monitor	CVE-2026-89035No exploit	MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypassmikrotik · routeros · CWE-613 Pre-auth Auth bypass	Critical9.1	—	0.2%	Oct 21, 2026
31Monitor	CVE-2026-92183Proof of concept	GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerabilitygimp · gimp · CWE-121 RCE Memory safety	High7.8	—	0.6%	Oct 21, 2026
31Monitor	CVE-2026-92202No exploit	Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerabilityluxion · keyshot · CWE-427 RCE	High7.8	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-92203No exploit	Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerabilityairbyte · airbyte · CWE-918 SSRF	High7.7	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-92204No exploit	Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerabilityairbyte · airbyte · CWE-918 SSRF	High7.7	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-92206No exploit	CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerabilitycrewai · crewai · CWE-470 pre-auth RCE	High8.8	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-92207No exploit	MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerabilitymindsdb · mindsdb · CWE-94 RCE	High8.8	—	0.6%	Oct 21, 2026
35Monitor	CVE-2026-92208Proof of concept	NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerabilitynomachine · nomachine · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.6%	Oct 21, 2026
31Monitor	CVE-2026-92209Proof of concept	NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerabilitynomachine · nomachine · CWE-331 RCE Auth bypass Local privilege escalation	High7.8	—	0.2%	Oct 21, 2026
28Monitor	CVE-2026-92210No exploit	NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerabilitynomachine · nomachine · CWE-918 Pre-auth SSRF	High7.2	—	0.3%	Oct 21, 2026
36Monitor	CVE-2025-31699No exploit	Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smugglingapache software foundation · apache traffic server · CWE-444 Pre-auth	Critical9.1	—	0.3%	Oct 21, 2026
28Monitor	CVE-2025-55702No exploit	Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new requestapache software foundation · apache traffic server · CWE-444 Pre-auth	High7.0	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-105934No exploit	Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topicapache software foundation · apache pulsar · CWE-862 Broken access control (IDOR)	High7.2	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-105937No exploit	Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic dataapache software foundation · apache pulsar · CWE-862 Broken access control (IDOR)	High8.7	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-105942No exploit	Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalationapache software foundation · apache pulsar · CWE-863 Broken access control (IDOR)	High7.7	—	0.4%	Oct 21, 2026
40Plan	CVE-2026-105944No exploit	Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeapache software foundation · apache pulsar manager · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.7%	Oct 21, 2026
30Monitor	CVE-2026-105945No exploit	Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storageapache software foundation · apache pulsar · CWE-22 Path traversal	High7.7	—	0.4%	Oct 21, 2026
33Monitor	CVE-2026-107588No exploit	Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Chartsvaadin · vaadin · CWE-79 XSS	High8.4	—	0.5%	Oct 21, 2026
34Monitor	CVE-2026-110803No exploit	Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8vaadin · framework · CWE-400 Pre-auth Denial of service	High8.7	—	0.2%	Oct 21, 2026
35Monitor	CVE-2026-111804No exploit	Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDsapache software foundation · apache traffic server · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Oct 21, 2026
40Plan	CVE-2026-111813No exploit	Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationapache software foundation · apache traffic server · CWE-88 Pre-auth	Critical10.0	—	0.4%	Oct 21, 2026
36Monitor	CVE-2026-111816No exploit	Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-outapache software foundation · apache traffic server · CWE-444 Pre-auth	Critical9.2	—	0.3%	Oct 21, 2026
34Monitor	CVE-2026-113870No exploit	Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsingmongodb · compass · CWE-116 pre-auth RCE	High8.6	—	0.2%	Oct 21, 2026
34Monitor	CVE-2026-114268No exploit	Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflowtenda · be3l pro · CWE-119 Memory safety	High8.6	—	0.5%	Oct 21, 2026
31Monitor	CVE-2026-19676No exploit	PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user modezephyrproject · zephyr · CWE-822	High7.8	—	0.1%	Oct 21, 2026
28Monitor	CVE-2026-78118No exploit	Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMPzephyrproject · zephyr · CWE-362 Race condition	High7.0	—	0.1%	Oct 21, 2026
28Monitor	CVE-2026-79976No exploit	NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controllerzephyrproject · zephyr · CWE-476 Pre-auth Memory safety	High7.1	—	0.2%	Oct 21, 2026
30Monitor	CVE-2026-111805No exploit	Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustionapache software foundation · apache traffic server · CWE-400 Pre-auth Denial of service	High7.7	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-111808No exploit	Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustionapache software foundation · apache traffic server · CWE-191 Pre-auth Memory safety	High7.7	—	0.4%	Oct 21, 2026

CVE-2026-114399
28Monitor
Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
trudesk project · trudeskOct 21, 2026
CVE-2026-114400
32Monitor
Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
trudesk project · trudeskOct 21, 2026
CVE-2026-114403
36Monitor
PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Deserialization
phpoffice · phppresentationOct 21, 2026
CVE-2026-114405
34Monitor
Denial of Service via Malformed VATP Packet in Velneo vServer
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
velneo · vserverOct 21, 2026
CVE-2026-19630
30Monitor
Amplified resource exhaustion in inbound message processing
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
isc · bind 9Oct 21, 2026
CVE-2026-82210
30Monitor
Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-82230
30Monitor
Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-82231
30Monitor
Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-82425
30Monitor
Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-82942
30Monitor
Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Race condition
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-84747
30Monitor
Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache brpcOct 21, 2026
CVE-2026-84748
30Monitor
Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache software foundation · apache brpcOct 21, 2026
CVE-2026-86146
30Monitor
Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-86147
30Monitor
Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
apache software foundation · apache brpcOct 21, 2026
CVE-2026-86249
36Monitor
Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache brpcOct 21, 2026
CVE-2026-94300
32Monitor
Concurrent GSS-TSIG messages corrupt memory
HighCVSS 8.1Proof of conceptEPSS 0%
- pre-auth RCE
- Race condition
isc · bind 9Oct 21, 2026
CVE-2026-96888
30Monitor
Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
isc · bind 9Oct 21, 2026
CVE-2026-97313
30Monitor
Specific RPZ configurations and query patterns may result in an unexpected exit
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
isc · bind 9Oct 21, 2026
CVE-2025-0326
29Monitor
Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
wso2 · wso2 identity serverOct 21, 2026
CVE-2026-104948
28Monitor
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the buil
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
enterprisedb · warehousepgOct 21, 2026
CVE-2026-109618
96Now
RCE via OOM corruption
CriticalCVSS 9.2KEVWeaponizedEPSS 99%
- pre-auth RCE
- Memory safety
php · phpOct 21, 2026
CVE-2026-109619
96Now
RCE via stale global state
CriticalCVSS 9.2KEVWeaponizedEPSS 99%
- pre-auth RCE
- Memory safety
php · phpOct 21, 2026
CVE-2023-7356
35Monitor
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 21, 2026
CVE-2026-111832
40Plan
WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- File upload
wp mailster · wp mailsterOct 21, 2026
CVE-2026-111833
30Monitor
WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
bold grid · weformsOct 21, 2026
CVE-2026-111834
39Monitor
WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- File upload
kitae park · mang board wpOct 21, 2026
CVE-2026-111838
28Monitor
WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
themehunk · themehunk customizerOct 21, 2026
CVE-2026-111840
28Monitor
WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
videowhisper.com · paid videochat turnkey siteOct 21, 2026
CVE-2026-111848
28Monitor
WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
dylan kuhn · geo mashupOct 21, 2026
CVE-2026-111852
37Monitor
WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
wpdreams · ajax search liteOct 21, 2026
CVE-2026-112221
28Monitor
WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
brainstorm force · surecartOct 21, 2026
CVE-2026-113779
35Monitor
pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
pfrest · pfsense-pkg-restapiOct 21, 2026
CVE-2026-98869
31Monitor
bpf: Infer zext_dst based on static register liveness analysis
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 21, 2026
CVE-2026-102483
30Monitor
Reachable Assertion in ntpsec
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ntpsec · ntpsecOct 21, 2026
CVE-2026-102486
30Monitor
Out-of-bounds Read in ntpsec
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ntpsec · ntpsecOct 21, 2026
CVE-2026-113788
37Monitor
Lagoon core ssh service vulnerable to remote code execution
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Command injection
uselagoon · lagoonOct 21, 2026
CVE-2026-114463
30Monitor
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-
HighCVSS 7.5No exploitEPSS 0%
- Broken access control (IDOR)
nous research · hermes agentOct 21, 2026
CVE-2026-114476
30Monitor
Incorrect Authorization in hMailServer
HighCVSS 7.5No exploitEPSS 0%
- Broken access control (IDOR)
progressive robot ltd · hmailserverOct 21, 2026
CVE-2026-114489
32Monitor
Missing Authorization in hMailServer
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
progressive robot ltd · hmailserverOct 21, 2026
CVE-2026-114490
31Monitor
Incorrect Authorization in hMailServer
HighCVSS 7.8No exploitEPSS 0%
- Broken access control (IDOR)
progressive robot ltd · hmailserverOct 21, 2026
CVE-2026-114123
30Monitor
D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
dynamics365ninja · d365fo-mcp-serverOct 21, 2026
CVE-2026-20043
36Monitor
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
- Memory safety
cisco · cisco cyber visionOct 21, 2026
CVE-2026-20236
30Monitor
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco cyber visionOct 21, 2026
CVE-2026-20291
31Monitor
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
cisco · cisco cyber visionOct 21, 2026
CVE-2026-20356
30Monitor
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco cyber visionOct 21, 2026
CVE-2026-76466
39Monitor
Cisco Expressway Series Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Hard-coded credentials
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76473
39Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76474
39Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76475
37Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76476
35Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76477
35Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76478
35Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76479
31Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities
HighCVSS 7.8No exploitEPSS 0%
- Path traversal
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76481
30Monitor
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco emergency responderOct 21, 2026
CVE-2026-76490
34Monitor
Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76491
30Monitor
Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76492
30Monitor
Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76493
30Monitor
Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76494
31Monitor
Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities
HighCVSS 7.8No exploitEPSS 0%
- RCE
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76495
31Monitor
Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities
HighCVSS 7.8No exploitEPSS 0%
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76496
28Monitor
Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities
HighCVSS 7.0No exploitEPSS 0%
cisco · cisco telepresence video communication server (vcs) expresswayOct 21, 2026
CVE-2026-76505
30Monitor
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco ios xr softwareOct 21, 2026
CVE-2026-76524
31Monitor
Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Auth bypass
- Local privilege escalation
cisco · cisco open source snort3Oct 21, 2026
CVE-2026-105869
36Monitor
Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
apache software foundation · apache pulsarOct 21, 2026
CVE-2026-110744
28Monitor
Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
HighCVSS 7.2No exploitEPSS 0%
red hat · multicluster global hubOct 21, 2026
CVE-2026-111183
39Monitor
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
gstreamer · gstreamerOct 21, 2026
CVE-2026-111184
31Monitor
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
nomachine · nomachineOct 21, 2026
CVE-2026-114125
34Monitor
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
storybookjs · storybookOct 21, 2026
CVE-2026-114126
34Monitor
Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
storybookjs · storybookOct 21, 2026
CVE-2026-114492
28Monitor
gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
flipped-aurora · gin-vue-adminOct 21, 2026
CVE-2026-114493
36Monitor
LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- SSRF
localai · localaiOct 21, 2026
CVE-2026-89035
36Monitor
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
mikrotik · routerosOct 21, 2026
CVE-2026-92183
31Monitor
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Memory safety
gimp · gimpOct 21, 2026
CVE-2026-92202
31Monitor
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
luxion · keyshotOct 21, 2026
CVE-2026-92203
30Monitor
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
HighCVSS 7.7No exploitEPSS 0%
- SSRF
airbyte · airbyteOct 21, 2026
CVE-2026-92204
30Monitor
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
HighCVSS 7.7No exploitEPSS 0%
- SSRF
airbyte · airbyteOct 21, 2026
CVE-2026-92206
35Monitor
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
crewai · crewaiOct 21, 2026
CVE-2026-92207
35Monitor
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- RCE
mindsdb · mindsdbOct 21, 2026
CVE-2026-92208
35Monitor
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
HighCVSS 8.8Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
nomachine · nomachineOct 21, 2026
CVE-2026-92209
31Monitor
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Auth bypass
- Local privilege escalation
nomachine · nomachineOct 21, 2026
CVE-2026-92210
28Monitor
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- SSRF
nomachine · nomachineOct 21, 2026
CVE-2025-31699
36Monitor
Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache software foundation · apache traffic serverOct 21, 2026
CVE-2025-55702
28Monitor
Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-105934
28Monitor
Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache pulsarOct 21, 2026
CVE-2026-105937
34Monitor
Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache pulsarOct 21, 2026
CVE-2026-105942
30Monitor
Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache pulsarOct 21, 2026
CVE-2026-105944
40Plan
Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache pulsar managerOct 21, 2026
CVE-2026-105945
30Monitor
Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
apache software foundation · apache pulsarOct 21, 2026
CVE-2026-107588
33Monitor
Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
HighCVSS 8.4No exploitEPSS 0%
- XSS
vaadin · vaadinOct 21, 2026
CVE-2026-110803
34Monitor
Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
vaadin · frameworkOct 21, 2026
CVE-2026-111804
35Monitor
Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111813
40Plan
Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111816
36Monitor
Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-113870
34Monitor
Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
mongodb · compassOct 21, 2026
CVE-2026-114268
34Monitor
Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
tenda · be3l proOct 21, 2026
CVE-2026-19676
31Monitor
PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode
HighCVSS 7.8No exploitEPSS 0%
zephyrproject · zephyrOct 21, 2026
CVE-2026-78118
28Monitor
Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP
HighCVSS 7.0No exploitEPSS 0%
- Race condition
zephyrproject · zephyrOct 21, 2026
CVE-2026-79976
28Monitor
NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrOct 21, 2026
CVE-2026-111805
30Monitor
Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111808
30Monitor
Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
apache software foundation · apache traffic serverOct 21, 2026