By publication date

Exploited and new serious CVEs: October 2026

8,744 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 69 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-109936No exploit	Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filterunknown · otter blocks · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Oct 23, 2026
28Monitor	CVE-2026-111982No exploit	Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Changeunknown · user profile builder · CWE-269	High7.2	—	0.3%	Oct 23, 2026
30Monitor	CVE-2026-113499No exploit	LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewritingunknown · litespeed cache · CWE-79 Pre-auth XSS	High7.5	—	0.3%	Oct 23, 2026
30Monitor	CVE-2026-113500No exploit	LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimizationunknown · litespeed cache · CWE-79 Pre-auth XSS	High7.5	—	0.3%	Oct 23, 2026
32Monitor	CVE-2026-94262No exploit	Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Actionunknown · advanced custom fields: extended · CWE-863 Pre-auth Broken access control (IDOR)	High8.1	—	0.2%	Oct 23, 2026
36Monitor	CVE-2026-94267No exploit	Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Actionunknown · advanced custom fields: extended · CWE-94 pre-auth RCE	Critical9.0	—	0.3%	Oct 23, 2026
32Monitor	CVE-2026-94268No exploit	Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Actionunknown · advanced custom fields: extended · CWE-269 Pre-auth	High8.1	—	0.3%	Oct 23, 2026
38Monitor	CVE-2026-55981No exploit	Firmware verification vulnerabilitycreative labs · creative sound blaster katana v2, v2x, se · CWE-494 Pre-auth	Critical9.6	—	0.1%	Oct 23, 2026
39Monitor	CVE-2026-63244No exploit	Authentication Bypass Vulnerabilitywizlearn technologies pte. ltd. · learning management system · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.6%	Oct 23, 2026
30Monitor	CVE-2026-75775No exploit	Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands wasus · router · CWE-78 pre-auth RCE Command injection	High7.7	—	0.6%	Oct 23, 2026
34Monitor	CVE-2026-75779No exploit	Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS asus · router · CWE-78 pre-auth RCE Command injection CSRF	High8.6	—	1.2%	Oct 23, 2026
34Monitor	CVE-2026-93489Proof of concept	Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subasus · router · CWE-287 Pre-auth Auth bypass	High8.7	—	0.2%	Oct 23, 2026
28Monitor	CVE-2025-30043No exploit	Missing Authentication in CGM CLININETcgm · cgm clininet · CWE-306 Pre-auth Auth bypass	High7.1	—	0.2%	Oct 23, 2026
34Monitor	CVE-2025-30045No exploit	Code Injection in CGM CLININETcgm · cgm clininet · CWE-94 RCE	High8.6	—	0.1%	Oct 23, 2026
36Monitor	CVE-2025-30046No exploit	Remote Code Execution in CGM CLININETcgm · cgm clininet · CWE-250 pre-auth RCE	Critical9.0	—	0.2%	Oct 23, 2026
37Monitor	CVE-2025-30047No exploit	Remote Code Execution via Java Deserialization in CGM CLININETcgm · cgm clininet · CWE-502 pre-auth RCE Deserialization	Critical9.4	—	0.3%	Oct 23, 2026
32Monitor	CVE-2025-30049No exploit	Use of Unsalted MD5 Password Hashes in CGM CLININETcgm · cgm clininet · CWE-916 Pre-auth	High8.2	—	0.2%	Oct 23, 2026
37Monitor	CVE-2025-30050No exploit	Remote Code Execution in CGM CLININETcgm · cgm clininet · CWE-94 pre-auth RCE	Critical9.4	—	0.2%	Oct 23, 2026
35Monitor	CVE-2025-30052No exploit	Authentication Bypass via IP Spoofing in CGM CLININET rsyncdcgm · cgm clininet · CWE-290 Pre-auth Auth bypass	High8.8	—	0.3%	Oct 23, 2026
37Monitor	CVE-2025-30054No exploit	Local Privilege Escalation in CGM CLININETcgm · cgm clininet · CWE-732 RCE Local privilege escalation	Critical9.3	—	0.1%	Oct 23, 2026
30Monitor	CVE-2026-112359No exploit	WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerabilityamauri.io · wpmobile.app · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-112835No exploit	WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikrentcar · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 23, 2026
34Monitor	CVE-2026-112837No exploit	WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerabilityruben garcia · gamipress · CWE-89 SQL injection	High8.5	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-112838No exploit	WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikrentcar · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 23, 2026
37Monitor	CVE-2026-112860No exploit	WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerabilityxnau webdesign · participants database · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112862No exploit	WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerabilityxnau webdesign · participants database · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 23, 2026
34Monitor	CVE-2026-16762No exploit	Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qtqt · qt · CWE-407 Pre-auth	High8.7	—	0.5%	Oct 23, 2026
28Monitor	CVE-2026-25716No exploit	BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking usershallo welt! gmbh · bluespice · CWE-862 Broken access control (IDOR)	High7.1	—	0.1%	Oct 23, 2026
37Monitor	CVE-2026-25784No exploit	bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysophallo welt! gmbh · bluespice · CWE-269 Pre-auth	Critical9.3	—	0.3%	Oct 23, 2026
35Monitor	CVE-2026-89320No exploit	HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityeclipse foundation · eclipse keypont - gose · CWE-354 Pre-auth	High8.8	—	0.1%	Oct 23, 2026
36Monitor	CVE-2026-107685No exploit	WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackersagentjido · req_llm · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.2%	Oct 23, 2026
34Monitor	CVE-2026-112904No exploit	Vvveb: Path Traversal in nextRestore() and nextBackup()givanz · vvveb · CWE-26 Path traversal	High8.7	—	0.4%	Oct 23, 2026
33Monitor	CVE-2026-115723No exploit	Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletiondavenardella · snap7 · CWE-787 Pre-auth Memory safety	High8.3	—	0.4%	Oct 23, 2026
34Monitor	CVE-2026-115726No exploit	Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settingsaider-ai · aider · CWE-78 RCE Local privilege escalation Command injection	High8.5	—	0.2%	Oct 23, 2026
36Monitor	CVE-2026-115727No exploit	AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_serverfosowl · agenticseek · CWE-489 pre-auth RCE	Critical9.2	—	0.6%	Oct 23, 2026
35Monitor	CVE-2026-56832No exploit	PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvalsmervinpraison · praisonai · CWE-345	High8.8	—	0.1%	Oct 23, 2026
30Monitor	CVE-2026-56833No exploit	PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversalmervinpraison · praisonai · CWE-22 Pre-auth Path traversal	High7.5	—	0.4%	Oct 23, 2026
30Monitor	CVE-2026-56834No exploit	PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storagemervinpraison · praisonai · CWE-22 Pre-auth Path traversal	High7.5	—	0.3%	Oct 23, 2026
33Monitor	CVE-2026-56835No exploit	PraisonAI Slack app_mention bypasses configured user/channel authorizationmervinpraison · praisonai · CWE-862 Broken access control (IDOR)	High8.3	—	0.2%	Oct 23, 2026
32Monitor	CVE-2026-56836No exploit	PraisonAI recipe serve Typer command bypasses the non-localhost authentication guardmervinpraison · praisonai · CWE-287 Pre-auth Auth bypass	High8.2	—	0.3%	Oct 23, 2026
34Monitor	CVE-2026-56837No exploit	PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingmervinpraison · praisonai · CWE-287 Pre-auth Auth bypass	High8.6	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-56838No exploit	PraisonAI recipe.run_stream skips dangerous-tool policy enforcementmervinpraison · praisonai · CWE-78 RCE Command injection	High7.8	—	0.1%	Oct 23, 2026
35Monitor	CVE-2026-56840No exploit	PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous toolsmervinpraison · praisonai · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 23, 2026
35Monitor	CVE-2026-98870No exploit	ksmbd: remove stale channels from all sessions on teardownlinux · linux	High8.8	—	0.5%	Oct 23, 2026
31Monitor	CVE-2026-98889No exploit	wifi: iwlwifi: mvm: fix sched scan IE sizinglinux · linux	High7.8	—	0.1%	Oct 23, 2026
28Monitor	CVE-2026-98895No exploit	net/mlx5: HWS, Handle destroying table that has a miss tablelinux · linux	High7.0	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98899No exploit	netfilter: ipset: mark the rcu locked areas properlylinux · linux	High7.8	—	0.1%	Oct 23, 2026
30Monitor	CVE-2026-98911No exploit	dpaa2-switch: fix the error path in dpaa2_switch_rx()linux · linux Pre-auth	High7.5	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112846No exploit	WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerabilitythemerex group · save life · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112847No exploit	WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerabilitythemerex · zensoul · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112848No exploit	WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerabilityaivahthemes · hostme v2 · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-112849No exploit	WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerabilityaivahthemes · hostme v2 · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 23, 2026
32Monitor	CVE-2026-112850No exploit	WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerabilityancorathemes · your dress · CWE-98 Pre-auth	High8.1	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112851No exploit	WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerabilitythemerex group · hotlock · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
32Monitor	CVE-2026-112852No exploit	WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerabilitythemerex group · helion · CWE-502 Pre-auth Deserialization	High8.1	—	0.2%	Oct 23, 2026
39Monitor	CVE-2026-112853No exploit	WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerabilityaxiomthemes · hallelujah · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 23, 2026
39Monitor	CVE-2026-112854No exploit	WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerabilityaxiomthemes · holistic center · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112855No exploit	WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerabilityaxiomthemes · redy · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112856No exploit	WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerabilitythemerex group · vagabonds · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112857No exploit	WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerabilityaxiomthemes · reprizo · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 23, 2026
39Monitor	CVE-2026-112858No exploit	WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerabilityaxiomthemes · rhodos · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-112859No exploit	WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerabilitythemerex group · little birdies · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-112863No exploit	WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerabilityhogash · kallyas · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 23, 2026
34Monitor	CVE-2026-115728No exploit	@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsinghapijs · @hapi/content · CWE-1333 Pre-auth Denial of service	High8.7	—	0.4%	Oct 23, 2026
35Monitor	CVE-2026-115729No exploit	@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypasspdfme · common · CWE-918 Pre-auth SSRF	High8.9	—	0.4%	Oct 23, 2026
35Monitor	CVE-2026-55888No exploit	XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversalflatpak · xdg-desktop-portal · CWE-22 Pre-auth Path traversal	High8.8	—	0.4%	Oct 23, 2026
33Monitor	CVE-2026-55889No exploit	XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer keyflatpak · xdg-desktop-portal · CWE-330 Pre-auth Weak crypto	High8.3	—	0.3%	Oct 23, 2026
32Monitor	CVE-2026-57113No exploit	PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletionmervinpraison · praisonai · CWE-22 Pre-auth Path traversal	High8.1	—	0.4%	Oct 23, 2026
28Monitor	CVE-2026-57114No exploit	PraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingmervinpraison · praisonai · CWE-367 Pre-auth SSRF Race condition	High7.2	—	0.2%	Oct 23, 2026
39Monitor	CVE-2026-57116No exploit	PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocationmervinpraison · praisonai · CWE-200 Pre-auth Info leak	Critical9.8	—	0.4%	Oct 23, 2026
35Monitor	CVE-2026-57117No exploit	PraisonAI: Compute-bridged file tools allow shell command injectionmervinpraison · praisonai · CWE-78 RCE Command injection	High8.8	—	0.5%	Oct 23, 2026
32Monitor	CVE-2026-57121No exploit	PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform APImervinpraison · praisonai · CWE-285 Broken access control (IDOR)	High8.1	—	0.3%	Oct 23, 2026
31Monitor	CVE-2026-57142No exploit	PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yamlmervinpraison · praisonai · CWE-78 RCE Command injection	High7.8	—	0.2%	Oct 23, 2026
35Monitor	CVE-2026-57144No exploit	PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailablemervinpraison · praisonai · CWE-266 Local privilege escalation	High8.8	—	0.2%	Oct 23, 2026
30Monitor	CVE-2026-57146No exploit	PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by defaultmervinpraison · praisonai · CWE-200 Pre-auth Auth bypass Info leak	High7.5	—	0.4%	Oct 23, 2026
28Monitor	CVE-2026-57209No exploit	Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Modedadrus · heimdall · CWE-20 Pre-auth	High7.0	—	0.4%	Oct 23, 2026
28Monitor	CVE-2026-57210No exploit	Heimdall: IP Spoofing via Unvalidated Forwarding Headersdadrus · heimdall · CWE-20 Pre-auth	High7.0	—	0.3%	Oct 23, 2026
33Monitor	CVE-2026-63120No exploit	PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Writeaiven-open · pghoard · CWE-22 RCE Path traversal	High8.4	—	0.4%	Oct 23, 2026
28Monitor	CVE-2026-98927No exploit	KVM: arm64: nv: Fix life cycle of the nested_mmus arraylinux · linux	High7.0	—	0.1%	Oct 23, 2026
29Monitor	CVE-2026-98932No exploit	EDAC/altera: Fix use-after-free in error pathslinux · linux	High7.4	—	0.1%	Oct 23, 2026
0Monitor	CVE-2026-98937Proof of concept	perf/core: Check kernel access when kernel callchains are requestedlinux · linux	—	—	0.2%	Oct 23, 2026
28Monitor	CVE-2026-98941No exploit	ext4: don't enable large folios on encrypted inodeslinux · linux	High7.0	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98944No exploit	HID: steam: Refactor registrationlinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98945No exploit	HID: steam: Rearrange teardown sequencelinux · linux	High7.8	—	0.1%	Oct 23, 2026
29Monitor	CVE-2026-98952No exploit	pfcp: make sure the SEID is linear before reading itlinux · linux Pre-auth	High7.3	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-98959No exploit	btrfs: fix xattr replace when multiple xattrs are packed in the same itemlinux · linux Pre-auth	Critical9.8	—	0.6%	Oct 23, 2026
30Monitor	CVE-2026-98964No exploit	nvmet: use the local P2P device on metadata allocation failurelinux · linux Pre-auth Denial of service	High7.5	—	0.6%	Oct 23, 2026
30Monitor	CVE-2026-98965No exploit	ice: Restore Ordered MMIO Writes for Tx Doorbellslinux · linux Pre-auth Denial of service	High7.5	—	0.5%	Oct 23, 2026
32Monitor	CVE-2026-98968No exploit	amt: send the relay's General Query directly from the receive pathlinux · linux Pre-auth	High8.1	—	0.5%	Oct 23, 2026
31Monitor	CVE-2026-98974No exploit	xfs: fix exchange-range-to-eof file size exchangelinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98975No exploit	xfs: stop exchanging reflink flags when exchanging mappingslinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98976No exploit	namespace: keep the lock on a mount that a propagated copy is moved beneathlinux · linux	High7.8	—	0.1%	Oct 23, 2026
33Monitor	CVE-2026-98978No exploit	namespace: never expire a locked mountlinux · linux	High8.4	—	0.1%	Oct 23, 2026
35Monitor	CVE-2026-98980No exploit	namei: don't reveal overmounted entries in refwalklinux · linux	High8.8	—	0.1%	Oct 23, 2026
35Monitor	CVE-2026-98981No exploit	namespace: unhash a dentry before detaching the mounts on itlinux · linux	High8.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98982No exploit	namespace: don't let a pseudo dentry become the root of a mountlinux · linux	High7.8	—	0.1%	Oct 23, 2026
35Monitor	CVE-2026-98988No exploit	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACElinux · linux Local privilege escalation	High8.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98991No exploit	namespace: queue a mount only once for mount notificationslinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98993No exploit	namespace: don't inherit MNT_UMOUNT in clone_mnt()linux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98995No exploit	namespace: reset the old parent's ->overmount in mnt_change_mountpoint()linux · linux	High7.8	—	0.1%	Oct 23, 2026

CVE-2026-109936
30Monitor
Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · otter blocksOct 23, 2026
CVE-2026-111982
28Monitor
Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
HighCVSS 7.2No exploitEPSS 0%
unknown · user profile builderOct 23, 2026
CVE-2026-113499
30Monitor
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · litespeed cacheOct 23, 2026
CVE-2026-113500
30Monitor
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · litespeed cacheOct 23, 2026
CVE-2026-94262
32Monitor
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · advanced custom fields: extendedOct 23, 2026
CVE-2026-94267
36Monitor
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
unknown · advanced custom fields: extendedOct 23, 2026
CVE-2026-94268
32Monitor
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
unknown · advanced custom fields: extendedOct 23, 2026
CVE-2026-55981
38Monitor
Firmware verification vulnerability
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
creative labs · creative sound blaster katana v2, v2x, seOct 23, 2026
CVE-2026-63244
39Monitor
Authentication Bypass Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
wizlearn technologies pte. ltd. · learning management systemOct 23, 2026
CVE-2026-75775
30Monitor
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands w
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Command injection
asus · routerOct 23, 2026
CVE-2026-75779
34Monitor
Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS
HighCVSS 8.6No exploitEPSS 1%
- pre-auth RCE
- Command injection
- CSRF
asus · routerOct 23, 2026
CVE-2026-93489
34Monitor
Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, sub
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
asus · routerOct 23, 2026
CVE-2025-30043
28Monitor
Missing Authentication in CGM CLININET
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
cgm · cgm clininetOct 23, 2026
CVE-2025-30045
34Monitor
Code Injection in CGM CLININET
HighCVSS 8.6No exploitEPSS 0%
- RCE
cgm · cgm clininetOct 23, 2026
CVE-2025-30046
36Monitor
Remote Code Execution in CGM CLININET
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
cgm · cgm clininetOct 23, 2026
CVE-2025-30047
37Monitor
Remote Code Execution via Java Deserialization in CGM CLININET
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
- Deserialization
cgm · cgm clininetOct 23, 2026
CVE-2025-30049
32Monitor
Use of Unsalted MD5 Password Hashes in CGM CLININET
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
cgm · cgm clininetOct 23, 2026
CVE-2025-30050
37Monitor
Remote Code Execution in CGM CLININET
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
cgm · cgm clininetOct 23, 2026
CVE-2025-30052
35Monitor
Authentication Bypass via IP Spoofing in CGM CLININET rsyncd
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
cgm · cgm clininetOct 23, 2026
CVE-2025-30054
37Monitor
Local Privilege Escalation in CGM CLININET
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- Local privilege escalation
cgm · cgm clininetOct 23, 2026
CVE-2026-112359
30Monitor
WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
amauri.io · wpmobile.appOct 23, 2026
CVE-2026-112835
28Monitor
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
e4jvikwp · vikrentcarOct 23, 2026
CVE-2026-112837
34Monitor
WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
ruben garcia · gamipressOct 23, 2026
CVE-2026-112838
28Monitor
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
e4jvikwp · vikrentcarOct 23, 2026
CVE-2026-112860
37Monitor
WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
xnau webdesign · participants databaseOct 23, 2026
CVE-2026-112862
39Monitor
WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
xnau webdesign · participants databaseOct 23, 2026
CVE-2026-16762
34Monitor
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
qt · qtOct 23, 2026
CVE-2026-25716
28Monitor
BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
hallo welt! gmbh · bluespiceOct 23, 2026
CVE-2026-25784
37Monitor
bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
hallo welt! gmbh · bluespiceOct 23, 2026
CVE-2026-89320
35Monitor
HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse keypont - goseOct 23, 2026
CVE-2026-107685
36Monitor
WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
agentjido · req_llmOct 23, 2026
CVE-2026-112904
34Monitor
Vvveb: Path Traversal in nextRestore() and nextBackup()
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
givanz · vvvebOct 23, 2026
CVE-2026-115723
33Monitor
Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
davenardella · snap7Oct 23, 2026
CVE-2026-115726
34Monitor
Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
aider-ai · aiderOct 23, 2026
CVE-2026-115727
36Monitor
AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
fosowl · agenticseekOct 23, 2026
CVE-2026-56832
35Monitor
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
HighCVSS 8.8No exploitEPSS 0%
mervinpraison · praisonaiOct 23, 2026
CVE-2026-56833
30Monitor
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
mervinpraison · praisonaiOct 23, 2026
CVE-2026-56834
30Monitor
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
mervinpraison · praisonaiOct 23, 2026
CVE-2026-56835
33Monitor
PraisonAI Slack app_mention bypasses configured user/channel authorization
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
mervinpraison · praisonaiOct 23, 2026
CVE-2026-56836
32Monitor
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
mervinpraison · praisonaiOct 23, 2026
CVE-2026-56837
34Monitor
PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
mervinpraison · praisonaiOct 23, 2026
CVE-2026-56838
31Monitor
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
mervinpraison · praisonaiOct 23, 2026
CVE-2026-56840
35Monitor
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
mervinpraison · praisonaiOct 23, 2026
CVE-2026-98870
35Monitor
ksmbd: remove stale channels from all sessions on teardown
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98889
31Monitor
wifi: iwlwifi: mvm: fix sched scan IE sizing
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98895
28Monitor
net/mlx5: HWS, Handle destroying table that has a miss table
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98899
31Monitor
netfilter: ipset: mark the rcu locked areas properly
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98911
30Monitor
dpaa2-switch: fix the error path in dpaa2_switch_rx()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-112846
39Monitor
WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex group · save lifeOct 23, 2026
CVE-2026-112847
39Monitor
WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · zensoulOct 23, 2026
CVE-2026-112848
39Monitor
WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
aivahthemes · hostme v2Oct 23, 2026
CVE-2026-112849
28Monitor
WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
aivahthemes · hostme v2Oct 23, 2026
CVE-2026-112850
32Monitor
WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
ancorathemes · your dressOct 23, 2026
CVE-2026-112851
39Monitor
WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex group · hotlockOct 23, 2026
CVE-2026-112852
32Monitor
WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex group · helionOct 23, 2026
CVE-2026-112853
39Monitor
WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · hallelujahOct 23, 2026
CVE-2026-112854
39Monitor
WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · holistic centerOct 23, 2026
CVE-2026-112855
39Monitor
WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · redyOct 23, 2026
CVE-2026-112856
39Monitor
WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex group · vagabondsOct 23, 2026
CVE-2026-112857
39Monitor
WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · reprizoOct 23, 2026
CVE-2026-112858
39Monitor
WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
axiomthemes · rhodosOct 23, 2026
CVE-2026-112859
39Monitor
WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex group · little birdiesOct 23, 2026
CVE-2026-112863
28Monitor
WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
hogash · kallyasOct 23, 2026
CVE-2026-115728
34Monitor
@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
hapijs · @hapi/contentOct 23, 2026
CVE-2026-115729
35Monitor
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- SSRF
pdfme · commonOct 23, 2026
CVE-2026-55888
35Monitor
XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
flatpak · xdg-desktop-portalOct 23, 2026
CVE-2026-55889
33Monitor
XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
flatpak · xdg-desktop-portalOct 23, 2026
CVE-2026-57113
32Monitor
PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Path traversal
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57114
28Monitor
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- SSRF
- Race condition
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57116
39Monitor
PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Info leak
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57117
35Monitor
PraisonAI: Compute-bridged file tools allow shell command injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57121
32Monitor
PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57142
31Monitor
PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57144
35Monitor
PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57146
30Monitor
PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Info leak
mervinpraison · praisonaiOct 23, 2026
CVE-2026-57209
28Monitor
Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
dadrus · heimdallOct 23, 2026
CVE-2026-57210
28Monitor
Heimdall: IP Spoofing via Unvalidated Forwarding Headers
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
dadrus · heimdallOct 23, 2026
CVE-2026-63120
33Monitor
PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Path traversal
aiven-open · pghoardOct 23, 2026
CVE-2026-98927
28Monitor
KVM: arm64: nv: Fix life cycle of the nested_mmus array
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98932
29Monitor
EDAC/altera: Fix use-after-free in error paths
HighCVSS 7.4No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98937
0Monitor
perf/core: Check kernel access when kernel callchains are requested
Proof of conceptEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98941
28Monitor
ext4: don't enable large folios on encrypted inodes
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98944
31Monitor
HID: steam: Refactor registration
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98945
31Monitor
HID: steam: Rearrange teardown sequence
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98952
29Monitor
pfcp: make sure the SEID is linear before reading it
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-98959
39Monitor
btrfs: fix xattr replace when multiple xattrs are packed in the same item
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-98964
30Monitor
nvmet: use the local P2P device on metadata allocation failure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxOct 23, 2026
CVE-2026-98965
30Monitor
ice: Restore Ordered MMIO Writes for Tx Doorbells
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxOct 23, 2026
CVE-2026-98968
32Monitor
amt: send the relay's General Query directly from the receive path
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-98974
31Monitor
xfs: fix exchange-range-to-eof file size exchange
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98975
31Monitor
xfs: stop exchanging reflink flags when exchanging mappings
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98976
31Monitor
namespace: keep the lock on a mount that a propagated copy is moved beneath
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98978
33Monitor
namespace: never expire a locked mount
HighCVSS 8.4No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98980
35Monitor
namei: don't reveal overmounted entries in refwalk
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98981
35Monitor
namespace: unhash a dentry before detaching the mounts on it
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98982
31Monitor
namespace: don't let a pseudo dentry become the root of a mount
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98988
35Monitor
namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxOct 23, 2026
CVE-2026-98991
31Monitor
namespace: queue a mount only once for mount notifications
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98993
31Monitor
namespace: don't inherit MNT_UMOUNT in clone_mnt()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98995
31Monitor
namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026