By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 66 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-111808No exploit	Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustionapache software foundation · apache traffic server · CWE-191 Pre-auth Memory safety	High7.7	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-111810No exploit	Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of serviceapache software foundation · apache traffic server · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Oct 21, 2026
37Monitor	CVE-2026-111811No exploit	Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authenticationapache software foundation · apache traffic server · CWE-306 Pre-auth Auth bypass	Critical9.4	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-111812No exploit	Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentialsapache software foundation · apache traffic server · CWE-863 Pre-auth Broken access control (IDOR)	High7.0	—	0.3%	Oct 21, 2026
31Monitor	CVE-2026-111814No exploit	Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the originapache software foundation · apache traffic server · CWE-295 Pre-auth Weak crypto	High7.8	—	0.2%	Oct 21, 2026
31Monitor	CVE-2026-111815No exploit	Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcementapache software foundation · apache traffic server · CWE-295 Pre-auth Weak crypto	High7.8	—	0.2%	Oct 21, 2026
32Monitor	CVE-2026-112381No exploit	Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked responseapache software foundation · apache traffic server · CWE-476 Pre-auth Memory safety	High8.2	—	0.3%	Oct 21, 2026
37Monitor	CVE-2026-112408No exploit	Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()aws · amazon sagemaker python sdk · CWE-940 Pre-auth	Critical9.4	—	0.7%	Oct 21, 2026
35Monitor	CVE-2026-114135No exploit	Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationjupyter-server · jupyter_server · CWE-862 Broken access control (IDOR)	High8.8	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-114136No exploit	Django REST framework: JSONParser applies an attacker-named codec to the request streamencode · django-rest-framework · CWE-409 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-113811No exploit	Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in searchCWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Oct 21, 2026
29Monitor	CVE-2026-114137No exploit	Django REST framework: TokenProxy.delete() reports success and revokes nothingencode · django-rest-framework · CWE-390 Pre-auth	High7.4	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-114138No exploit	Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationencode · django-rest-framework · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 21, 2026
36Monitor	CVE-2026-114139No exploit	Sentry-Javascript: Middleware Bypass when using Tunnel routegetsentry · sentry-javascript · CWE-693 Pre-auth	Critical9.1	—	0.5%	Oct 21, 2026
35Monitor	CVE-2026-114140Proof of concept	nbconvert: File write via path traversal in cell output filenamesjupyter · nbconvert · CWE-22 Path traversal	High8.8	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-114141No exploit	toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()binarymuse · toml-node · CWE-407 Pre-auth	High8.7	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-114142No exploit	toml-node: Prototype pollution: parsing a TOML document can write to Object.prototypebinarymuse · toml-node · CWE-1321 Pre-auth Prototype pollution	High8.8	—	0.5%	Oct 21, 2026
34Monitor	CVE-2026-114143No exploit	toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()binarymuse · toml-node · CWE-407 Pre-auth	High8.7	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-114144No exploit	toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()binarymuse · toml-node · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-114145No exploit	GitPython validates a submodule's ".git" path only after cloning into it (RCE)gitpython-developers · gitpython · CWE-696 pre-auth RCE	High7.5	—	0.4%	Oct 21, 2026
34Monitor	CVE-2026-29001No exploit	TastyIgniter 4.4.5 PHP Object Injection via Settings Deserializationtastyigniter · tastyigniter · CWE-502 RCE Deserialization	High8.6	—	0.7%	Oct 21, 2026
30Monitor	CVE-2026-82987No exploit	There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attaviewsonic · vcast · CWE-306 Pre-auth Auth bypass	High7.5	—	0.5%	Oct 21, 2026
28Monitor	CVE-2026-96637No exploit	Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSpython · pillow · CWE-400 Pre-auth Denial of service	High7.1	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-96639No exploit	Pillow multi-frame loaders can reuse stale native image storage after mode transitionspython · pillow · CWE-125 pre-auth RCE Memory safety	Critical9.8	—	0.6%	Oct 21, 2026
32Monitor	CVE-2026-96640No exploit	Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionpython · pillow · CWE-400 Pre-auth Denial of service	High8.2	—	0.6%	Oct 21, 2026
28Monitor	CVE-2026-96642No exploit	Pillow: TarIO negative size field causes infinite CPU-spin looppython · pillow · CWE-835 Pre-auth Denial of service	High7.1	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-96643No exploit	Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timepython · pillow · CWE-407 Pre-auth	High7.1	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-96644No exploit	Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)python · pillow · CWE-125 Pre-auth Memory safety	High7.1	—	0.3%	Oct 21, 2026
30Monitor	CVE-2026-96778Proof of concept	Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferpython · pillow · CWE-787 Pre-auth Memory safety	High7.7	—	0.4%	Oct 21, 2026
29Monitor	CVE-2026-112921No exploit	Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous requestCWE-488 Pre-auth	High7.3	—	0.3%	Oct 21, 2026
37Monitor	CVE-2026-114382No exploit	TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflowtotolink · ex200 · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.6%	Oct 21, 2026
37Monitor	CVE-2026-114383No exploit	TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflowtotolink · ex200 · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.6%	Oct 21, 2026
37Monitor	CVE-2026-114509Proof of concept	Laravel TokenGuard authentication bypass through non-string API credentialslaravel · framework · CWE-287 Pre-auth Auth bypass	Critical9.2	—	1.8%	Oct 21, 2026
36Monitor	CVE-2026-91403Proof of concept	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).oracle corporation · oracle java se · CWE-327 Pre-auth Weak crypto	Critical9.1	—	0.3%	Oct 21, 2026
36Monitor	CVE-2026-94140No exploit	Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=noCWE-322 Pre-auth	Critical9.1	—	0.4%	Oct 21, 2026
36Monitor	CVE-2026-94423No exploit	Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hostsCWE-322 Pre-auth	Critical9.1	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-103090No exploit	Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)google · sam · CWE-306 Pre-auth Auth bypass	High8.8	—	0.5%	Oct 21, 2026
30Monitor	CVE-2026-76288No exploit	Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprisesplunk · splunk · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-76290No exploit	Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprisesplunk · splunk · CWE-400 Pre-auth Auth bypass Denial of service	High7.5	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-76291No exploit	Improper Access Control through Scheduled Search Safeguards in Splunk Enterprisesplunk · splunk · CWE-284 Broken access control (IDOR)	High8.8	—	0.3%	Oct 21, 2026
28Monitor	CVE-2026-76293No exploit	Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprisesplunk · splunk · CWE-94 RCE	High7.2	—	0.4%	Oct 21, 2026
35Monitor	CVE-2026-76298No exploit	Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprisesplunk · splunk · CWE-321 Hard-coded credentials	High8.8	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-76299No exploit	Security Hardening in Splunk Enterprise - October 2026splunk · splunk enterprise · CWE-284 Broken access control (IDOR)	Critical9.9	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-76300No exploit	Security Hardening in Splunk Enterprise - October 2026splunk · splunk enterprise · CWE-664	High8.8	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-76301No exploit	Security Hardening in Splunk Enterprise - October 2026splunk · splunk enterprise · CWE-693 Pre-auth	Critical9.8	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-76302No exploit	Security Hardening in Splunk Enterprise - October 2026splunk · splunk enterprise · CWE-707	Critical9.9	—	0.4%	Oct 21, 2026
30Monitor	CVE-2026-76306No exploit	Information Disclosure through REST API Query Filters in Splunk SOARsplunk · splunk soar · CWE-200 Info leak	High7.5	—	0.2%	Oct 21, 2026
28Monitor	CVE-2026-76307No exploit	Sensitive Information Disclosure through REST API Query Filters in Splunk SOARsplunk · splunk soar · CWE-200 Info leak	High7.2	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-76407No exploit	Improper Access Control in Splunk SOARsplunk · splunk soar · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.4%	Oct 21, 2026
39Monitor	CVE-2026-76408No exploit	Improper Control of a Resource Through its Lifetime in Splunk SOARsplunk · splunk soar · CWE-664 Pre-auth	Critical9.8	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-76526No exploit	Improper Neutralization in Splunk SOARsplunk · splunk soar · CWE-707	High8.8	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-76527No exploit	Improper Check or Handling of Exceptional Conditions in Splunk SOARsplunk · splunk soar · CWE-703 Pre-auth	Critical9.8	—	0.4%	Oct 21, 2026
39Monitor	CVE-2026-76528No exploit	Protection Mechanism Failure in Splunk SOARsplunk · splunk soar · CWE-693 Pre-auth	Critical9.8	—	0.3%	Oct 21, 2026
39Monitor	CVE-2026-76529No exploit	Improper Protection of Alternate Path in Splunk SOARsplunk · splunk soar · CWE-424 Pre-auth	Critical9.8	—	0.3%	Oct 21, 2026
35Monitor	CVE-2026-76530No exploit	Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOARsplunk · splunk soar · CWE-647	High8.8	—	0.2%	Oct 21, 2026
39Monitor	CVE-2026-76531No exploit	Files or Directories Accessible to External Parties in Splunk SOARsplunk · splunk soar · CWE-552	Critical9.9	—	0.4%	Oct 21, 2026
23Monitor	CVE-2026-89052Proof of concept	Hardcoded AES encryption key in Archer C6tp-link systems inc. · archer c6 v2 · CWE-321 Hard-coded credentials	Medium5.9	—	0.3%	Oct 21, 2026
40Plan	CVE-2026-110264Proof of concept	Integer Overflow or Wraparound in GitLabgitlab · gitlab · CWE-190 pre-auth RCE Memory safety	Critical10.0	—	1.3%	Oct 22, 2026
30Monitor	CVE-2026-112212No exploit	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLabgitlab · gitlab · CWE-444 Pre-auth	High7.5	—	0.1%	Oct 22, 2026
38Monitor	CVE-2026-114575No exploit	TOTOLINK A950RG product.so UploadCustomModule command injectiontotolink · a950rg · CWE-74 pre-auth RCE Command injection	Critical9.3	—	2.2%	Oct 22, 2026
32Monitor	CVE-2026-15723No exploit	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLabgitlab · gitlab · CWE-90	High8.2	—	0.5%	Oct 22, 2026
28Monitor	CVE-2026-16255No exploit	Incorrect Authorization in GitLabgitlab · gitlab · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Oct 22, 2026
28Monitor	CVE-2026-114633No exploit	WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.phpwwbn · avideo · CWE-863 Broken access control (IDOR)	High7.0	—	0.4%	Oct 22, 2026
28Monitor	CVE-2026-114635No exploit	Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Schemetraefik · traefik · CWE-288 Pre-auth Auth bypass	High7.0	—	0.1%	Oct 22, 2026
28Monitor	CVE-2026-114636No exploit	Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Routertraefik · traefik · CWE-306 Pre-auth Auth bypass	High7.0	—	0.2%	Oct 22, 2026
28Monitor	CVE-2026-114637No exploit	Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leaktraefik · traefik · CWE-488 Pre-auth Auth bypass	High7.0	—	0.2%	Oct 22, 2026
28Monitor	CVE-2026-114638No exploit	Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collisiontraefik · traefik · CWE-287 Pre-auth Auth bypass	High7.0	—	0.2%	Oct 22, 2026
28Monitor	CVE-2026-114639No exploit	Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pooltraefik · traefik · CWE-287 Pre-auth Auth bypass	High7.0	—	0.2%	Oct 22, 2026
28Monitor	CVE-2026-114640No exploit	Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Routertraefik · traefik · CWE-290 Pre-auth Auth bypass	High7.0	—	0.1%	Oct 22, 2026
28Monitor	CVE-2026-114642No exploit	Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Trippertraefik · traefik · CWE-295 Pre-auth Weak crypto	High7.0	—	0.1%	Oct 22, 2026
27Monitor	CVE-2026-114656Proof of concept	Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matchertraefik · traefik · CWE-436 Pre-auth Auth bypass	Medium6.9	—	0.1%	Oct 22, 2026
34Monitor	CVE-2026-114658No exploit	Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invitegetgrav · grav-plugin-login · CWE-269	High8.7	—	0.2%	Oct 22, 2026
28Monitor	CVE-2026-114659No exploit	Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routesgetgrav · grav-plugin-flex-objects · CWE-424	High7.1	—	0.6%	Oct 22, 2026
28Monitor	CVE-2026-114660No exploit	Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directivesgetgrav · grav · CWE-470	High7.0	—	0.2%	Oct 22, 2026
36Monitor	CVE-2026-114661No exploit	OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpointsopenremote · openremote · CWE-862 Broken access control (IDOR)	Critical9.0	—	0.3%	Oct 22, 2026
34Monitor	CVE-2026-114662No exploit	Obot before 0.26.0 API Key Theft via CLI Login Token Requestobot-platform · obot · CWE-352 Pre-auth Auth bypass CSRF	High8.6	—	0.1%	Oct 22, 2026
34Monitor	CVE-2026-114663No exploit	Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Argumentsvyperlang · vyper · CWE-706	High8.6	—	0.1%	Oct 22, 2026
28Monitor	CVE-2026-114664No exploit	Frappe before 16.33.0 Blind SQL Injection via get_eventsfrappe · frappe · CWE-89 SQL injection	High7.1	—	0.1%	Oct 22, 2026
32Monitor	CVE-2026-114715No exploit	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the roundcube · webmail · CWE-863 Broken access control (IDOR)	High8.1	—	0.3%	Oct 22, 2026
34Monitor	CVE-2026-114716No exploit	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.roundcube · webmail · CWE-99	High8.5	—	0.3%	Oct 22, 2026
28Monitor	CVE-2026-114720No exploit	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.roundcube · webmail · CWE-93 RCE Command injection	High7.1	—	0.7%	Oct 22, 2026
32Monitor	CVE-2026-114724No exploit	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().roundcube · webmail · CWE-502 Pre-auth Deserialization	High8.1	—	0.4%	Oct 22, 2026
33Monitor	CVE-2026-114727No exploit	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.roundcube · webmail · CWE-829	High8.3	—	0.3%	Oct 22, 2026
36Monitor	CVE-2026-96355No exploit	Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175drupal · webform · CWE-1336 pre-auth RCE SSTI	Critical9.1	—	0.4%	Oct 22, 2026
30Monitor	CVE-2026-96365No exploit	Webform - Less critical - Denial of service - SA-CONTRIB-2026-170drupal · webform · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Oct 22, 2026
30Monitor	CVE-2026-110353No exploit	HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncatehaproxy · haproxy · CWE-252 Pre-auth Denial of service	High7.5	—	0.7%	Oct 22, 2026
30Monitor	CVE-2026-110354No exploit	HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via ahaproxy · haproxy · CWE-835 Pre-auth Denial of service	High7.5	—	0.8%	Oct 22, 2026
28Monitor	CVE-2026-114730No exploit	Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.roundcube · webmail · CWE-918 Pre-auth SSRF	High7.2	—	0.3%	Oct 22, 2026
32Monitor	CVE-2026-114732No exploit	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations.roundcube · webmail · CWE-288 Auth bypass	High8.1	—	0.3%	Oct 22, 2026
36Monitor	CVE-2026-114219No exploit	NewType Infortech｜NT OneAPP - Hard-coded Credentialsnewtype infortech · nt oneapp · CWE-798 Pre-auth Hard-coded credentials	Critical9.1	—	0.3%	Oct 22, 2026
37Monitor	CVE-2026-114220No exploit	NewType Infortech｜NT OneAPP - Improper Certificate Validationnewtype infortech · nt oneapp · CWE-295 Pre-auth Weak crypto	Critical9.3	—	0.1%	Oct 22, 2026
28Monitor	CVE-2026-109927No exploit	CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_roleunknown · hipaa forms · CWE-269	High7.2	—	0.4%	Oct 22, 2026
28Monitor	CVE-2026-109987No exploit	PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookieunknown · pixelyoursite · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 22, 2026
30Monitor	CVE-2026-111958No exploit	Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Tokenunknown · royal mcp · CWE-287 Auth bypass	High7.5	—	0.2%	Oct 22, 2026
30Monitor	CVE-2026-97328No exploit	WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parserunknown · webp express · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Oct 22, 2026
34Monitor	CVE-2026-105270No exploit	Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionarekinath · esaml · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Oct 22, 2026
35Monitor	CVE-2026-114177No exploit	WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerabilityxpro · xpro elementor addons · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 22, 2026
28Monitor	CVE-2026-111830No exploit	WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerabilitywp mailster · wp mailster · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 22, 2026
30Monitor	CVE-2026-111851No exploit	WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerabilitywproyal · royal elementor addons · CWE-470 RCE	High7.6	—	0.2%	Oct 22, 2026
39Monitor	CVE-2026-112241No exploit	WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerabilitybrainstorm force · surecart · CWE-290 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 22, 2026

CVE-2026-111808
30Monitor
Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111810
34Monitor
Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111811
37Monitor
Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111812
28Monitor
Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111814
31Monitor
Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-111815
31Monitor
Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-112381
32Monitor
Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
apache software foundation · apache traffic serverOct 21, 2026
CVE-2026-112408
37Monitor
Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
aws · amazon sagemaker python sdkOct 21, 2026
CVE-2026-114135
35Monitor
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
jupyter-server · jupyter_serverOct 21, 2026
CVE-2026-114136
30Monitor
Django REST framework: JSONParser applies an attacker-named codec to the request stream
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
encode · django-rest-frameworkOct 21, 2026
CVE-2026-113811
30Monitor
Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 21, 2026
CVE-2026-114137
29Monitor
Django REST framework: TokenProxy.delete() reports success and revokes nothing
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
encode · django-rest-frameworkOct 21, 2026
CVE-2026-114138
30Monitor
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
encode · django-rest-frameworkOct 21, 2026
CVE-2026-114139
36Monitor
Sentry-Javascript: Middleware Bypass when using Tunnel route
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
getsentry · sentry-javascriptOct 21, 2026
CVE-2026-114140
35Monitor
nbconvert: File write via path traversal in cell output filenames
HighCVSS 8.8Proof of conceptEPSS 0%
- Path traversal
jupyter · nbconvertOct 21, 2026
CVE-2026-114141
34Monitor
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
binarymuse · toml-nodeOct 21, 2026
CVE-2026-114142
35Monitor
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Prototype pollution
binarymuse · toml-nodeOct 21, 2026
CVE-2026-114143
34Monitor
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
binarymuse · toml-nodeOct 21, 2026
CVE-2026-114144
30Monitor
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
binarymuse · toml-nodeOct 21, 2026
CVE-2026-114145
30Monitor
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
gitpython-developers · gitpythonOct 21, 2026
CVE-2026-29001
34Monitor
TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Deserialization
tastyigniter · tastyigniterOct 21, 2026
CVE-2026-82987
30Monitor
There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated atta
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
viewsonic · vcastOct 21, 2026
CVE-2026-96637
28Monitor
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
python · pillowOct 21, 2026
CVE-2026-96639
39Monitor
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
python · pillowOct 21, 2026
CVE-2026-96640
32Monitor
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
python · pillowOct 21, 2026
CVE-2026-96642
28Monitor
Pillow: TarIO negative size field causes infinite CPU-spin loop
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
python · pillowOct 21, 2026
CVE-2026-96643
28Monitor
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
python · pillowOct 21, 2026
CVE-2026-96644
28Monitor
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 21, 2026
CVE-2026-96778
30Monitor
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
HighCVSS 7.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
python · pillowOct 21, 2026
CVE-2026-112921
29Monitor
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
Oct 21, 2026
CVE-2026-114382
37Monitor
TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
totolink · ex200Oct 21, 2026
CVE-2026-114383
37Monitor
TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
totolink · ex200Oct 21, 2026
CVE-2026-114509
37Monitor
Laravel TokenGuard authentication bypass through non-string API credentials
CriticalCVSS 9.2Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
laravel · frameworkOct 21, 2026
CVE-2026-91403
36Monitor
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
oracle corporation · oracle java seOct 21, 2026
CVE-2026-94140
36Monitor
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 21, 2026
CVE-2026-94423
36Monitor
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 21, 2026
CVE-2026-103090
35Monitor
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
google · samOct 21, 2026
CVE-2026-76288
30Monitor
Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
splunk · splunkOct 21, 2026
CVE-2026-76290
30Monitor
Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
splunk · splunkOct 21, 2026
CVE-2026-76291
35Monitor
Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
splunk · splunkOct 21, 2026
CVE-2026-76293
28Monitor
Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise
HighCVSS 7.2No exploitEPSS 0%
- RCE
splunk · splunkOct 21, 2026
CVE-2026-76298
35Monitor
Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise
HighCVSS 8.8No exploitEPSS 0%
- Hard-coded credentials
splunk · splunkOct 21, 2026
CVE-2026-76299
39Monitor
Security Hardening in Splunk Enterprise - October 2026
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
splunk · splunk enterpriseOct 21, 2026
CVE-2026-76300
35Monitor
Security Hardening in Splunk Enterprise - October 2026
HighCVSS 8.8No exploitEPSS 0%
splunk · splunk enterpriseOct 21, 2026
CVE-2026-76301
39Monitor
Security Hardening in Splunk Enterprise - October 2026
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
splunk · splunk enterpriseOct 21, 2026
CVE-2026-76302
39Monitor
Security Hardening in Splunk Enterprise - October 2026
CriticalCVSS 9.9No exploitEPSS 0%
splunk · splunk enterpriseOct 21, 2026
CVE-2026-76306
30Monitor
Information Disclosure through REST API Query Filters in Splunk SOAR
HighCVSS 7.5No exploitEPSS 0%
- Info leak
splunk · splunk soarOct 21, 2026
CVE-2026-76307
28Monitor
Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR
HighCVSS 7.2No exploitEPSS 0%
- Info leak
splunk · splunk soarOct 21, 2026
CVE-2026-76407
39Monitor
Improper Access Control in Splunk SOAR
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
splunk · splunk soarOct 21, 2026
CVE-2026-76408
39Monitor
Improper Control of a Resource Through its Lifetime in Splunk SOAR
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
splunk · splunk soarOct 21, 2026
CVE-2026-76526
35Monitor
Improper Neutralization in Splunk SOAR
HighCVSS 8.8No exploitEPSS 0%
splunk · splunk soarOct 21, 2026
CVE-2026-76527
39Monitor
Improper Check or Handling of Exceptional Conditions in Splunk SOAR
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
splunk · splunk soarOct 21, 2026
CVE-2026-76528
39Monitor
Protection Mechanism Failure in Splunk SOAR
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
splunk · splunk soarOct 21, 2026
CVE-2026-76529
39Monitor
Improper Protection of Alternate Path in Splunk SOAR
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
splunk · splunk soarOct 21, 2026
CVE-2026-76530
35Monitor
Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR
HighCVSS 8.8No exploitEPSS 0%
splunk · splunk soarOct 21, 2026
CVE-2026-76531
39Monitor
Files or Directories Accessible to External Parties in Splunk SOAR
CriticalCVSS 9.9No exploitEPSS 0%
splunk · splunk soarOct 21, 2026
CVE-2026-89052
23Monitor
Hardcoded AES encryption key in Archer C6
MediumCVSS 5.9Proof of conceptEPSS 0%
- Hard-coded credentials
tp-link systems inc. · archer c6 v2Oct 21, 2026
CVE-2026-110264
40Plan
Integer Overflow or Wraparound in GitLab
CriticalCVSS 10.0Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
gitlab · gitlabOct 22, 2026
CVE-2026-112212
30Monitor
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
gitlab · gitlabOct 22, 2026
CVE-2026-114575
38Monitor
TOTOLINK A950RG product.so UploadCustomModule command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
totolink · a950rgOct 22, 2026
CVE-2026-15723
32Monitor
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
HighCVSS 8.2No exploitEPSS 0%
gitlab · gitlabOct 22, 2026
CVE-2026-16255
28Monitor
Incorrect Authorization in GitLab
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
gitlab · gitlabOct 22, 2026
CVE-2026-114633
28Monitor
WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
HighCVSS 7.0No exploitEPSS 0%
- Broken access control (IDOR)
wwbn · avideoOct 22, 2026
CVE-2026-114635
28Monitor
Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 22, 2026
CVE-2026-114636
28Monitor
Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 22, 2026
CVE-2026-114637
28Monitor
Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 22, 2026
CVE-2026-114638
28Monitor
Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 22, 2026
CVE-2026-114639
28Monitor
Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 22, 2026
CVE-2026-114640
28Monitor
Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 22, 2026
CVE-2026-114642
28Monitor
Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
traefik · traefikOct 22, 2026
CVE-2026-114656
27Monitor
Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 22, 2026
CVE-2026-114658
34Monitor
Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite
HighCVSS 8.7No exploitEPSS 0%
getgrav · grav-plugin-loginOct 22, 2026
CVE-2026-114659
28Monitor
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
HighCVSS 7.1No exploitEPSS 0%
getgrav · grav-plugin-flex-objectsOct 22, 2026
CVE-2026-114660
28Monitor
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
HighCVSS 7.0No exploitEPSS 0%
getgrav · gravOct 22, 2026
CVE-2026-114661
36Monitor
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
CriticalCVSS 9.0No exploitEPSS 0%
- Broken access control (IDOR)
openremote · openremoteOct 22, 2026
CVE-2026-114662
34Monitor
Obot before 0.26.0 API Key Theft via CLI Login Token Request
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
obot-platform · obotOct 22, 2026
CVE-2026-114663
34Monitor
Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
HighCVSS 8.6No exploitEPSS 0%
vyperlang · vyperOct 22, 2026
CVE-2026-114664
28Monitor
Frappe before 16.33.0 Blind SQL Injection via get_events
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · frappeOct 22, 2026
CVE-2026-114715
32Monitor
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
roundcube · webmailOct 22, 2026
CVE-2026-114716
34Monitor
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.
HighCVSS 8.5No exploitEPSS 0%
roundcube · webmailOct 22, 2026
CVE-2026-114720
28Monitor
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Command injection
roundcube · webmailOct 22, 2026
CVE-2026-114724
32Monitor
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Deserialization
roundcube · webmailOct 22, 2026
CVE-2026-114727
33Monitor
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.
HighCVSS 8.3No exploitEPSS 0%
roundcube · webmailOct 22, 2026
CVE-2026-96355
36Monitor
Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
- SSTI
drupal · webformOct 22, 2026
CVE-2026-96365
30Monitor
Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
drupal · webformOct 22, 2026
CVE-2026-110353
30Monitor
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncate
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
haproxy · haproxyOct 22, 2026
CVE-2026-110354
30Monitor
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
haproxy · haproxyOct 22, 2026
CVE-2026-114730
28Monitor
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- SSRF
roundcube · webmailOct 22, 2026
CVE-2026-114732
32Monitor
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations.
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
roundcube · webmailOct 22, 2026
CVE-2026-114219
36Monitor
NewType Infortech｜NT OneAPP - Hard-coded Credentials
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
newtype infortech · nt oneappOct 22, 2026
CVE-2026-114220
37Monitor
NewType Infortech｜NT OneAPP - Improper Certificate Validation
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
newtype infortech · nt oneappOct 22, 2026
CVE-2026-109927
28Monitor
CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
HighCVSS 7.2No exploitEPSS 0%
unknown · hipaa formsOct 22, 2026
CVE-2026-109987
28Monitor
PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
unknown · pixelyoursiteOct 22, 2026
CVE-2026-111958
30Monitor
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · royal mcpOct 22, 2026
CVE-2026-97328
30Monitor
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · webp expressOct 22, 2026
CVE-2026-105270
34Monitor
Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
arekinath · esamlOct 22, 2026
CVE-2026-114177
35Monitor
WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
xpro · xpro elementor addonsOct 22, 2026
CVE-2026-111830
28Monitor
WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp mailster · wp mailsterOct 22, 2026
CVE-2026-111851
30Monitor
WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability
HighCVSS 7.6No exploitEPSS 0%
- RCE
wproyal · royal elementor addonsOct 22, 2026
CVE-2026-112241
39Monitor
WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
brainstorm force · surecartOct 22, 2026