By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 70 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-98988No exploit	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACElinux · linux Local privilege escalation	High8.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98991No exploit	namespace: queue a mount only once for mount notificationslinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98993No exploit	namespace: don't inherit MNT_UMOUNT in clone_mnt()linux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98995No exploit	namespace: reset the old parent's ->overmount in mnt_change_mountpoint()linux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-98999No exploit	drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpinlinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99002No exploit	drm/vmwgfx: validate pitch coming from userspacelinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99006No exploit	drm/i915/gem: Prevent overstepping exec array boundarylinux · linux	High7.8	—	0.1%	Oct 23, 2026
28Monitor	CVE-2026-99011No exploit	Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()linux · linux Pre-auth	High7.1	—	0.2%	Oct 23, 2026
31Monitor	CVE-2026-99012No exploit	Bluetooth: ISO: Serialize concurrent connect callslinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99013No exploit	Bluetooth: ISO: Reject concurrent BIS listener setuplinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99014No exploit	Bluetooth: hci_sync: Fix command skb lifetime during scan setuplinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99016No exploit	riscv: futex: untag the user pointer before the atomic accesslinux · linux	High7.8	—	0.1%	Oct 23, 2026
28Monitor	CVE-2026-99017No exploit	riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITElinux · linux	High7.0	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99018No exploit	riscv: entry: gate shadow call stack reload on sstatus.SPP, not tplinux · linux	High7.8	—	0.1%	Oct 23, 2026
30Monitor	CVE-2026-99030No exploit	net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()linux · linux Pre-auth	High7.5	—	0.4%	Oct 23, 2026
31Monitor	CVE-2026-99032No exploit	net/smc: protect clcsock lifetime in smc_getnamelinux · linux	High7.8	—	0.1%	Oct 23, 2026
33Monitor	CVE-2026-99042No exploit	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6linux · linux	High8.4	—	0.1%	Oct 23, 2026
30Monitor	CVE-2026-99046No exploit	gve: fix XSK buffer leak on error descriptorlinux · linux Pre-auth Denial of service	High7.5	—	0.5%	Oct 23, 2026
31Monitor	CVE-2026-99050No exploit	gpio: mpsse: fix race when arming the IRQ poll workerlinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99051No exploit	fsverity: RCU-delay the freeing of struct fsverity_infolinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99053No exploit	tipc: hold a reference to nodes found by link namelinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99054No exploit	tipc: destroy topsrv workqueues before closing connectionslinux · linux	High7.8	—	0.1%	Oct 23, 2026
31Monitor	CVE-2026-99056No exploit	strparser: make sure __strp_recv isn't running before tearing down the parserlinux · linux Race condition	High7.8	—	0.1%	Oct 23, 2026
30Monitor	CVE-2026-99059No exploit	wireguard: noise: reject response consumption after intermediate initiationlinux · linux Pre-auth	High7.7	—	0.5%	Oct 23, 2026
32Monitor	CVE-2026-99064No exploit	cipso: adjust cached option offsets when removing CIPSOlinux · linux Pre-auth	High8.1	—	0.5%	Oct 23, 2026
29Monitor	CVE-2026-99077No exploit	ipv4: udp: Create exceptions before socket matchinglinux · linux Pre-auth	High7.4	—	0.4%	Oct 23, 2026
39Monitor	CVE-2026-99078No exploit	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retrylinux · linux Pre-auth	Critical9.8	—	0.4%	Oct 23, 2026
39Monitor	CVE-2026-99079No exploit	net/mlx5e: Prevent stale XSK buffer release on refill retrylinux · linux Pre-auth	Critical9.8	—	0.4%	Oct 23, 2026
30Monitor	CVE-2026-99081No exploit	bnxt_en: fix DMA mapping length for padded small packetslinux · linux Pre-auth Denial of service	High7.5	—	0.5%	Oct 23, 2026
35Monitor	CVE-2026-99082No exploit	KVM: x86: Use active memslots for the per-vCPU MMIO cachelinux · linux	High8.8	—	0.1%	Oct 23, 2026
35Monitor	CVE-2026-99083No exploit	ksmbd: fix heap out-of-bounds write in krb5_authenticate()linux · linux	High8.8	—	0.4%	Oct 23, 2026
34Monitor	CVE-2026-10632No exploit	Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameterzimbra · zimbra collaboration suite · CWE-79 XSS	High8.7	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-114353No exploit	DJI CrystalSky ZS600C USB-gadget backdoor allows root command executiondji · crystalsky zs600c · CWE-912 RCE	High7.0	—	0.1%	Oct 23, 2026
34Monitor	CVE-2026-114354No exploit	DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as rootdji · crystalsky zs600c · CWE-78 RCE Local privilege escalation Command injection	High8.6	—	0.1%	Oct 23, 2026
34Monitor	CVE-2026-114355No exploit	DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as rootdji · crystalsky zs600c · CWE-78 RCE Local privilege escalation Command injection	High8.6	—	1.2%	Oct 23, 2026
28Monitor	CVE-2026-114356No exploit	DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorizationdji · crystalsky zs600c · CWE-862 Local privilege escalation Broken access control (IDOR)	High7.0	—	0.1%	Oct 23, 2026
37Monitor	CVE-2026-114357No exploit	DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)dji · crystalsky zs600c · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.3%	Oct 23, 2026
35Monitor	CVE-2026-114621No exploit	baserCMS: SQL injection in the admin panel and admin APIbaserproject · basercms · CWE-89 RCE SQL injection	High8.8	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-114622No exploit	baserCMS: Encoded path traversal bypass in the theme file APIbaserproject · basercms · CWE-22 Path traversal	High7.2	—	0.6%	Oct 23, 2026
28Monitor	CVE-2026-114624No exploit	baserCMS: PHP object injection via unguarded unserialize() in the widget-area entitybaserproject · basercms · CWE-502 Deserialization XSS	High7.2	—	0.8%	Oct 23, 2026
28Monitor	CVE-2026-115457No exploit	baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Commentsbaserproject · basercms · CWE-79 Pre-auth XSS CSRF	High7.1	—	0.4%	Oct 23, 2026
34Monitor	CVE-2026-115481No exploit	baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file uploadbaserproject · basercms · CWE-434 RCE File upload	High8.5	—	0.4%	Oct 23, 2026
31Monitor	CVE-2026-50056No exploit	Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injectionzimbra · zimbra collaboration suite · CWE-88 RCE Local privilege escalation	High7.8	—	0.3%	Oct 23, 2026
31Monitor	CVE-2026-50057No exploit	Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissionszimbra · zimbra collaboration suite · CWE-732 RCE Local privilege escalation	High7.8	—	0.2%	Oct 23, 2026
35Monitor	CVE-2026-53918No exploit	odhcpd DHCPv6 IA dangling first pointer use-after-freeopenwrt · odhcpd · CWE-416 Pre-auth Memory safety	High8.8	—	0.6%	Oct 23, 2026
34Monitor	CVE-2026-53920No exploit	odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosureopenwrt · odhcpd · CWE-125 Pre-auth Memory safety	High8.7	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-53921Proof of concept	odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)openwrt · odhcpd · CWE-121 Pre-auth Memory safety	Critical9.8	—	1.1%	Oct 23, 2026
34Monitor	CVE-2026-55826No exploit	Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Pluginstape-io · gtm-server-side-wordpress-plugin · CWE-200 Pre-auth Info leak	High8.7	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-93631No exploit	Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linkingsynacor · zimbra collaboration suite · CWE-352 Pre-auth CSRF	High7.1	—	0.1%	Oct 23, 2026
34Monitor	CVE-2026-93639No exploit	Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalationzimbra · zimbra collaboration suite · CWE-862 Broken access control (IDOR)	High8.7	—	0.3%	Oct 23, 2026
31Monitor	CVE-2026-93640No exploit	Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configurationzimbra · zimbra collaboration suite · CWE-732 Local privilege escalation	High7.8	—	0.1%	Oct 23, 2026
34Monitor	CVE-2026-102786No exploit	Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5phoca.cz · phoca gallery extension for joomla · CWE-79 Pre-auth XSS	High8.6	—	0.2%	Oct 23, 2026
30Monitor	CVE-2026-106763No exploit	An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCWE-78 pre-auth RCE Command injection	High7.5	—	0.5%	Oct 23, 2026
30Monitor	CVE-2026-106764No exploit	An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.CWE-94 pre-auth RCE	High7.5	—	0.5%	Oct 23, 2026
30Monitor	CVE-2026-106765No exploit	An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.CWE-78 pre-auth RCE Command injection	High7.5	—	0.5%	Oct 23, 2026
28Monitor	CVE-2026-115477No exploit	obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTPthe-40-thieves · obsidian-tc · CWE-285 Broken access control (IDOR)	High7.1	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-115478No exploit	obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesthe-40-thieves · obsidian-tc · CWE-459	High7.1	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-39902Proof of concept	Cacti: Authenticated RCE on Data Inputcacti · cacti · CWE-78 RCE Command injection	High7.2	—	0.4%	Oct 23, 2026
39Monitor	CVE-2026-46651No exploit	Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerintranda · goobi-viewer-core · CWE-306 Pre-auth Auth bypass SSRF	Critical9.8	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-46652No exploit	Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerintranda · goobi-viewer-core · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	0.7%	Oct 23, 2026
39Monitor	CVE-2026-53942No exploit	Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKENconda · infrastructure · CWE-94 RCE	Critical9.9	—	0.3%	Oct 23, 2026
34Monitor	CVE-2026-54668No exploit	Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)kitodo · kitodo-production · CWE-611 XXE	High8.7	—	0.3%	Oct 23, 2026
29Monitor	CVE-2026-55457No exploit	Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypassintranda · goobi-viewer-core · CWE-287 Pre-auth Auth bypass	High7.4	—	0.2%	Oct 23, 2026
29Monitor	CVE-2026-55459No exploit	Goobi viewer: OpenID JWT audience not enforced by the verifierintranda · goobi-viewer-core · CWE-287 Pre-auth Auth bypass	High7.4	—	0.2%	Oct 23, 2026
37Monitor	CVE-2026-55486No exploit	Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSSintranda · goobi-viewer-core · CWE-79 Pre-auth XSS	Critical9.3	—	0.2%	Oct 23, 2026
34Monitor	CVE-2026-58497No exploit	Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsolo-dot-io · uni-cli · CWE-346 Pre-auth	High8.6	—	0.2%	Oct 23, 2026
29Monitor	CVE-2025-45528No exploit	An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDFCWE-94 RCE	High7.3	—	0.1%	Oct 23, 2026
30Monitor	CVE-2026-50787Proof of concept	e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php.CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 23, 2026
36Monitor	CVE-2026-52356No exploit	An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to executCWE-78 RCE Command injection	High8.8	—	2.1%	Oct 23, 2026
34Monitor	CVE-2026-57845Proof of concept	Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builderhuggingface · datasets · CWE-502 pre-auth RCE Deserialization	High8.7	—	0.5%	Oct 23, 2026
26Monitor	CVE-2026-105481Proof of concept	A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the nodejs · node · CWE-367 Pre-auth Race condition	Medium6.5	—	0.3%	Oct 23, 2026
29Monitor	CVE-2026-105482Proof of concept	A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.revnodejs · node · CWE-284 Pre-auth Broken access control (IDOR)	High7.4	—	0.4%	Oct 23, 2026
29Monitor	CVE-2026-105483Proof of concept	A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 anodejs · node · CWE-295 Pre-auth Weak crypto	High7.4	—	0.3%	Oct 23, 2026
29Monitor	CVE-2026-106069Proof of concept	A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the cnodejs · node · CWE-295 Pre-auth Weak crypto	High7.4	—	0.3%	Oct 23, 2026
14Monitor	CVE-2026-106070Proof of concept	A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central nodejs · node · CWE-840 Pre-auth	Low3.7	—	0.3%	Oct 23, 2026
14Monitor	CVE-2026-106071Proof of concept	A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allnodejs · node · CWE-284 Broken access control (IDOR)	Low3.6	—	0.1%	Oct 23, 2026
26Monitor	CVE-2026-106072Proof of concept	A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connectsnodejs · node · CWE-295 Weak crypto	Medium6.7	—	0.6%	Oct 23, 2026
13Monitor	CVE-2026-106073Proof of concept	A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.nodejs · node · CWE-284 Broken access control (IDOR)	Low3.3	—	0.2%	Oct 23, 2026
19Monitor	CVE-2026-106074Proof of concept	A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(nodejs · node · CWE-330 Pre-auth Weak crypto	Medium4.8	—	0.3%	Oct 23, 2026
33Monitor	CVE-2026-87901No exploit	Improper sanitization in the registration module allows reflected Cross-Site Scripting.phpbb · phpbb · CWE-79 Pre-auth XSS	High8.3	—	0.3%	Oct 23, 2026
29Monitor	CVE-2026-110975No exploit	Autotune: kruize/autotune: kruize/autotune: datasources credential disclosureCWE-256 Pre-auth	High7.4	—	0.2%	Oct 23, 2026
37Monitor	CVE-2026-115812No exploit	Relative path traversal during model archive extraction in Amazon Web Services Multi Model Serveraws · multi-model-server · CWE-23 pre-auth RCE Path traversal	Critical9.3	—	0.5%	Oct 23, 2026
30Monitor	CVE-2026-115863No exploit	ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.connman · connman · CWE-121 Pre-auth Auth bypass Memory safety	High7.6	—	0.2%	Oct 23, 2026
28Monitor	CVE-2026-112342No exploit	Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoningtandoor recipes · tandoor recipes · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Oct 23, 2026
29Monitor	CVE-2026-115570No exploit	Electron: Mitigation for compromised eMudhra intermediate certificateselectron · electron · CWE-299 Pre-auth	High7.4	—	0.3%	Oct 23, 2026
34Monitor	CVE-2026-91093No exploit	HP One Agent Software – Security Updatehp inc. · hp one agent software · CWE-427 RCE Local privilege escalation	High8.5	—	0.1%	Oct 23, 2026
28Monitor	CVE-2026-115572No exploit	pypdf: Possible long runtimes for repeated references to the same missing objectpy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High7.1	—	0.3%	Oct 23, 2026
28Monitor	CVE-2026-115580No exploit	pypdf: Possible long runtimes for large xref table header limitspy-pdf · pypdf · CWE-834 Pre-auth	High7.1	—	0.4%	Oct 23, 2026
28Monitor	CVE-2026-115585No exploit	pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)py-pdf · pypdf · CWE-400 Pre-auth Denial of service	High7.1	—	0.4%	Oct 23, 2026
28Monitor	CVE-2026-115586No exploit	virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)pypa · virtualenv · CWE-78 RCE Command injection	High7.1	—	0.2%	Oct 23, 2026
30Monitor	CVE-2026-19741No exploit	OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)zephyrproject · zephyr · CWE-1392 Pre-auth Hard-coded credentials	High7.5	—	0.2%	Oct 23, 2026
32Monitor	CVE-2026-79977No exploit	WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyrzephyrproject · zephyr · CWE-306 Pre-auth Auth bypass	High8.2	—	0.2%	Oct 23, 2026
31Monitor	CVE-2026-79979No exploit	Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frameszephyrproject · zephyr · CWE-416 Memory safety	High7.8	—	0.1%	Oct 23, 2026
35Monitor	CVE-2026-79982No exploit	Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet sizezephyrproject · zephyr · CWE-787 Pre-auth Memory safety	High8.8	—	0.2%	Oct 23, 2026
29Monitor	GHSA-q54r-jf2p-rfr2No exploit	gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()CWE-349	High7.3	—	—	Oct 23, 2026
30Monitor	CVE-2026-113877No exploit	HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressionsCWE-624 Pre-auth Denial of service	High7.5	—	0.7%	Oct 23, 2026
31Monitor	CVE-2026-113951No exploit	If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetesapple · container · CWE-276 RCE	High7.8	—	0.2%	Oct 23, 2026
34Monitor	CVE-2026-115775No exploit	Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Treetwisted · twisted · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Oct 23, 2026
30Monitor	CVE-2026-115776No exploit	Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffertwisted · twisted · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 23, 2026
30Monitor	CVE-2026-115778No exploit	Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffertwisted · twisted · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 23, 2026

CVE-2026-98988
35Monitor
namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxOct 23, 2026
CVE-2026-98991
31Monitor
namespace: queue a mount only once for mount notifications
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98993
31Monitor
namespace: don't inherit MNT_UMOUNT in clone_mnt()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98995
31Monitor
namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-98999
31Monitor
drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99002
31Monitor
drm/vmwgfx: validate pitch coming from userspace
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99006
31Monitor
drm/i915/gem: Prevent overstepping exec array boundary
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99011
28Monitor
Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-99012
31Monitor
Bluetooth: ISO: Serialize concurrent connect calls
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99013
31Monitor
Bluetooth: ISO: Reject concurrent BIS listener setup
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99014
31Monitor
Bluetooth: hci_sync: Fix command skb lifetime during scan setup
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99016
31Monitor
riscv: futex: untag the user pointer before the atomic access
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99017
28Monitor
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99018
31Monitor
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99030
30Monitor
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-99032
31Monitor
net/smc: protect clcsock lifetime in smc_getname
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99042
33Monitor
io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
HighCVSS 8.4No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99046
30Monitor
gve: fix XSK buffer leak on error descriptor
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxOct 23, 2026
CVE-2026-99050
31Monitor
gpio: mpsse: fix race when arming the IRQ poll worker
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99051
31Monitor
fsverity: RCU-delay the freeing of struct fsverity_info
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99053
31Monitor
tipc: hold a reference to nodes found by link name
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99054
31Monitor
tipc: destroy topsrv workqueues before closing connections
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99056
31Monitor
strparser: make sure __strp_recv isn't running before tearing down the parser
HighCVSS 7.8No exploitEPSS 0%
- Race condition
linux · linuxOct 23, 2026
CVE-2026-99059
30Monitor
wireguard: noise: reject response consumption after intermediate initiation
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-99064
32Monitor
cipso: adjust cached option offsets when removing CIPSO
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-99077
29Monitor
ipv4: udp: Create exceptions before socket matching
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-99078
39Monitor
net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-99079
39Monitor
net/mlx5e: Prevent stale XSK buffer release on refill retry
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 23, 2026
CVE-2026-99081
30Monitor
bnxt_en: fix DMA mapping length for padded small packets
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxOct 23, 2026
CVE-2026-99082
35Monitor
KVM: x86: Use active memslots for the per-vCPU MMIO cache
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-99083
35Monitor
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 23, 2026
CVE-2026-10632
34Monitor
Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter
HighCVSS 8.7No exploitEPSS 0%
- XSS
zimbra · zimbra collaboration suiteOct 23, 2026
CVE-2026-114353
28Monitor
DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution
HighCVSS 7.0No exploitEPSS 0%
- RCE
dji · crystalsky zs600cOct 23, 2026
CVE-2026-114354
34Monitor
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
dji · crystalsky zs600cOct 23, 2026
CVE-2026-114355
34Monitor
DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Local privilege escalation
- Command injection
dji · crystalsky zs600cOct 23, 2026
CVE-2026-114356
28Monitor
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
dji · crystalsky zs600cOct 23, 2026
CVE-2026-114357
37Monitor
DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
dji · crystalsky zs600cOct 23, 2026
CVE-2026-114621
35Monitor
baserCMS: SQL injection in the admin panel and admin API
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
baserproject · basercmsOct 23, 2026
CVE-2026-114622
28Monitor
baserCMS: Encoded path traversal bypass in the theme file API
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
baserproject · basercmsOct 23, 2026
CVE-2026-114624
28Monitor
baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
- XSS
baserproject · basercmsOct 23, 2026
CVE-2026-115457
28Monitor
baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
baserproject · basercmsOct 23, 2026
CVE-2026-115481
34Monitor
baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload
HighCVSS 8.5No exploitEPSS 0%
- RCE
- File upload
baserproject · basercmsOct 23, 2026
CVE-2026-50056
31Monitor
Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
zimbra · zimbra collaboration suiteOct 23, 2026
CVE-2026-50057
31Monitor
Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
zimbra · zimbra collaboration suiteOct 23, 2026
CVE-2026-53918
35Monitor
odhcpd DHCPv6 IA dangling first pointer use-after-free
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
openwrt · odhcpdOct 23, 2026
CVE-2026-53920
34Monitor
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
openwrt · odhcpdOct 23, 2026
CVE-2026-53921
39Monitor
odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Memory safety
openwrt · odhcpdOct 23, 2026
CVE-2026-55826
34Monitor
Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
stape-io · gtm-server-side-wordpress-pluginOct 23, 2026
CVE-2026-93631
28Monitor
Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
synacor · zimbra collaboration suiteOct 23, 2026
CVE-2026-93639
34Monitor
Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
zimbra · zimbra collaboration suiteOct 23, 2026
CVE-2026-93640
31Monitor
Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
zimbra · zimbra collaboration suiteOct 23, 2026
CVE-2026-102786
34Monitor
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
phoca.cz · phoca gallery extension for joomlaOct 23, 2026
CVE-2026-106763
30Monitor
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitize
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Command injection
Oct 23, 2026
CVE-2026-106764
30Monitor
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
Oct 23, 2026
CVE-2026-106765
30Monitor
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Command injection
Oct 23, 2026
CVE-2026-115477
28Monitor
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
the-40-thieves · obsidian-tcOct 23, 2026
CVE-2026-115478
28Monitor
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
HighCVSS 7.1No exploitEPSS 0%
the-40-thieves · obsidian-tcOct 23, 2026
CVE-2026-39902
28Monitor
Cacti: Authenticated RCE on Data Input
HighCVSS 7.2Proof of conceptEPSS 0%
- RCE
- Command injection
cacti · cactiOct 23, 2026
CVE-2026-46651
39Monitor
Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
intranda · goobi-viewer-coreOct 23, 2026
CVE-2026-46652
39Monitor
Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Path traversal
intranda · goobi-viewer-coreOct 23, 2026
CVE-2026-53942
39Monitor
Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
conda · infrastructureOct 23, 2026
CVE-2026-54668
34Monitor
Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)
HighCVSS 8.7No exploitEPSS 0%
- XXE
kitodo · kitodo-productionOct 23, 2026
CVE-2026-55457
29Monitor
Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
intranda · goobi-viewer-coreOct 23, 2026
CVE-2026-55459
29Monitor
Goobi viewer: OpenID JWT audience not enforced by the verifier
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
intranda · goobi-viewer-coreOct 23, 2026
CVE-2026-55486
37Monitor
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
intranda · goobi-viewer-coreOct 23, 2026
CVE-2026-58497
34Monitor
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
olo-dot-io · uni-cliOct 23, 2026
CVE-2025-45528
29Monitor
An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
HighCVSS 7.3No exploitEPSS 0%
- RCE
Oct 23, 2026
CVE-2026-50787
30Monitor
e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
Oct 23, 2026
CVE-2026-52356
36Monitor
An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execut
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
Oct 23, 2026
CVE-2026-57845
34Monitor
Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder
HighCVSS 8.7Proof of conceptEPSS 0%
- pre-auth RCE
- Deserialization
huggingface · datasetsOct 23, 2026
CVE-2026-105481
26Monitor
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Race condition
nodejs · nodeOct 23, 2026
CVE-2026-105482
29Monitor
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.rev
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
nodejs · nodeOct 23, 2026
CVE-2026-105483
29Monitor
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 a
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
nodejs · nodeOct 23, 2026
CVE-2026-106069
29Monitor
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the c
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
nodejs · nodeOct 23, 2026
CVE-2026-106070
14Monitor
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central
LowCVSS 3.7Proof of conceptEPSS 0%
- Pre-auth
nodejs · nodeOct 23, 2026
CVE-2026-106071
14Monitor
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--all
LowCVSS 3.6Proof of conceptEPSS 0%
- Broken access control (IDOR)
nodejs · nodeOct 23, 2026
CVE-2026-106072
26Monitor
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects
MediumCVSS 6.7Proof of conceptEPSS 0%
- Weak crypto
nodejs · nodeOct 23, 2026
CVE-2026-106073
13Monitor
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.
LowCVSS 3.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
nodejs · nodeOct 23, 2026
CVE-2026-106074
19Monitor
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
nodejs · nodeOct 23, 2026
CVE-2026-87901
33Monitor
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- XSS
phpbb · phpbbOct 23, 2026
CVE-2026-110975
29Monitor
Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
Oct 23, 2026
CVE-2026-115812
37Monitor
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Path traversal
aws · multi-model-serverOct 23, 2026
CVE-2026-115863
30Monitor
ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Memory safety
connman · connmanOct 23, 2026
CVE-2026-112342
28Monitor
Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
tandoor recipes · tandoor recipesOct 23, 2026
CVE-2026-115570
29Monitor
Electron: Mitigation for compromised eMudhra intermediate certificates
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
electron · electronOct 23, 2026
CVE-2026-91093
34Monitor
HP One Agent Software – Security Update
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
hp inc. · hp one agent softwareOct 23, 2026
CVE-2026-115572
28Monitor
pypdf: Possible long runtimes for repeated references to the same missing object
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 23, 2026
CVE-2026-115580
28Monitor
pypdf: Possible long runtimes for large xref table header limits
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
py-pdf · pypdfOct 23, 2026
CVE-2026-115585
28Monitor
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 23, 2026
CVE-2026-115586
28Monitor
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Command injection
pypa · virtualenvOct 23, 2026
CVE-2026-19741
30Monitor
OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
zephyrproject · zephyrOct 23, 2026
CVE-2026-79977
32Monitor
WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
zephyrproject · zephyrOct 23, 2026
CVE-2026-79979
31Monitor
Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyrOct 23, 2026
CVE-2026-79982
35Monitor
Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrOct 23, 2026
GHSA-q54r-jf2p-rfr2
29Monitor
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()
HighCVSS 7.3No exploit
Oct 23, 2026
CVE-2026-113877
30Monitor
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 23, 2026
CVE-2026-113951
31Monitor
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes
HighCVSS 7.8No exploitEPSS 0%
- RCE
apple · containerOct 23, 2026
CVE-2026-115775
34Monitor
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
twisted · twistedOct 23, 2026
CVE-2026-115776
30Monitor
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
twisted · twistedOct 23, 2026
CVE-2026-115778
30Monitor
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
twisted · twistedOct 23, 2026