By publication date

Exploited and new serious CVEs: October 2026

8,741 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 71 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-115895No exploit	Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executioncapricorn86 · happy-dom · CWE-94 pre-auth RCE	High8.8	—	0.4%	Oct 23, 2026
34Monitor	CVE-2026-115935No exploit	Control panel only API response emulation replaces "securityKey" and reaches server RCEcraftcms · cms · CWE-94 RCE	High8.7	—	0.3%	Oct 23, 2026
34Monitor	CVE-2026-115937No exploit	Unauthenticated payment reuse allows unpaid orders to be marked as paidcraftcms · commerce-mollie · CWE-345 Pre-auth	High8.7	—	0.1%	Oct 23, 2026
34Monitor	CVE-2026-115938No exploit	Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEcraftcms · cms · CWE-1336 RCE SSTI	High8.7	—	0.3%	Oct 23, 2026
39Monitor	CVE-2026-115931No exploit	Arbitrary file read and backend crash through unrestricted provider method callsgitroomhq · postiz-app · CWE-73 Path traversal	Critical9.9	—	0.4%	Oct 23, 2026
30Monitor	CVE-2026-115929No exploit	MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAsmongodb, inc. · compass · CWE-295 Pre-auth Weak crypto	High7.6	—	0.1%	Oct 24, 2026
39Monitor	CVE-2026-115806No exploit	Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replacecodexonics · prime mover – backup and migration · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Oct 24, 2026
28Monitor	CVE-2026-115807No exploit	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gcozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editor · CWE-269	High7.1	—	0.2%	Oct 24, 2026
39Monitor	CVE-2026-110956No exploit	asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validationunknown · asvereinbase · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 24, 2026
28Monitor	CVE-2026-112207No exploit	Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Linkunknown · download monitor · CWE-79 pre-auth RCE XSS	High7.1	—	0.2%	Oct 24, 2026
28Monitor	CVE-2026-113673No exploit	GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Exportunknown · geodirectory · CWE-94 RCE	High7.2	—	0.5%	Oct 24, 2026
37Monitor	CVE-2026-111402No exploit	WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerabilitytribulant software · newsletters · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 24, 2026
28Monitor	CVE-2026-112844No exploit	WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerabilityarraytics · wp event solution · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 24, 2026
37Monitor	CVE-2026-112866Proof of concept	WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerabilitywpfactory · product filter by wbw · CWE-89 Pre-auth SQL injection	Critical9.3	—	1.1%	Oct 24, 2026
28Monitor	CVE-2026-112869No exploit	WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilitynoah hearle · we’re open! · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 24, 2026
28Monitor	CVE-2026-114178No exploit	WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerabilitybold grid · w3 total cache · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 24, 2026
28Monitor	CVE-2026-114179No exploit	WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilitywordplus · bp better messages · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 24, 2026
39Monitor	CVE-2026-114196No exploit	WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerabilitypaytiumsupport · paytium · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 24, 2026
28Monitor	CVE-2026-114694No exploit	WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerabilitypixelite · events manager · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 24, 2026
28Monitor	CVE-2026-114695No exploit	WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerabilityinfomaniak network · vod infomaniak · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 24, 2026
28Monitor	CVE-2026-114697No exploit	WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerabilityquarka · qa analytics · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 24, 2026
28Monitor	CVE-2026-115975No exploit	Broken access control in JiraControllercervantessec · cervantes · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 24, 2026
39Monitor	CVE-2026-94075No exploit	WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerabilitytribulant software · newsletters · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 24, 2026
35Monitor	CVE-2026-110018No exploit	aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attributekodezen · ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder · CWE-269	High8.8	—	0.3%	Oct 24, 2026
34Monitor	CVE-2026-116009No exploit	Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Actionowen2345 · camaleon-cms · CWE-22 RCE Path traversal	High8.7	—	0.4%	Oct 24, 2026
34Monitor	CVE-2026-116011Proof of concept	Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()crowcpp · crow · CWE-674 Pre-auth Denial of service	High8.7	—	0.6%	Oct 24, 2026
8Monitor	CVE-2026-116012Proof of concept	Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parsernationalsecurityagency · ghidra · CWE-197	Low2.0	—	0.2%	Oct 24, 2026
36Monitor	CVE-2026-116014No exploit	open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataTypeopen62541 · open62541 · CWE-190 Pre-auth Memory safety	Critical9.2	—	0.4%	Oct 24, 2026
28Monitor	CVE-2026-116016No exploit	yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Headeryunaiv · yudao-cloud · CWE-807	High7.1	—	0.2%	Oct 24, 2026
34Monitor	CVE-2026-116019No exploit	Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directivesgetgrav · grav · CWE-749	High8.7	—	0.3%	Oct 24, 2026
38Monitor	CVE-2026-115932No exploit	Path traversal in post media lets any registered user read server filesgitroomhq · postiz-app · CWE-22 Path traversal	Critical9.6	—	0.4%	Oct 24, 2026
30Monitor	CVE-2026-114191No exploit	WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerabilityknit pay · upi qr code payment gateway for woocommerce · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 24, 2026
30Monitor	CVE-2026-114629No exploit	Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parametersCWE-789 Pre-auth	High7.5	—	0.4%	Oct 24, 2026
28Monitor	CVE-2026-114704No exploit	WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerabilitychristoph vielgrader · relevanssi · CWE-502 Deserialization	High7.2	—	0.4%	Oct 24, 2026
37Monitor	CVE-2026-115557No exploit	Distrust compromised intermediate certificates in ssl modulepython software foundation · cpython · CWE-299 Pre-auth	Critical9.4	—	0.5%	Oct 24, 2026
39Monitor	CVE-2026-115933No exploit	Forged signed tokens let any registered user take over other users and organizationsgitroomhq · postiz-app · CWE-290 Auth bypass	Critical9.9	—	0.2%	Oct 24, 2026
36Monitor	CVE-2026-114820Proof of concept	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).oracle corporation · oracle java se · CWE-327 Pre-auth Weak crypto	Critical9.1	—	0.2%	Oct 24, 2026
37Monitor	CVE-2026-115995No exploit	Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injectionunitree robotics · unitree go2 · CWE-77 pre-auth RCE Command injection	Critical9.4	—	1.3%	Oct 24, 2026
22Monitor	CVE-2026-116000Proof of concept	Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgeryzylon · privategpt · CWE-918 Pre-auth SSRF	Medium5.5	—	0.2%	Oct 25, 2026
8Monitor	CVE-2026-116004Proof of concept	onyx-dot-app Onyx PreviewTab.tsx cross site scriptingonyx-dot-app · onyx · CWE-79 XSS	Low2.0	—	0.1%	Oct 25, 2026
22Monitor	CVE-2026-116006Proof of concept	YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authenticationyunaiv · ruoyi-vue-pro · CWE-287 Pre-auth Auth bypass	Medium5.5	—	0.8%	Oct 25, 2026
39Monitor	CVE-2026-115214No exploit	Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headersunknown · datawiza proxy auth plugin · CWE-269 Pre-auth	Critical9.8	—	0.2%	Oct 25, 2026
28Monitor	CVE-2026-115251No exploit	Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgradeunknown · duplicator · CWE-269 Auth bypass	High7.2	—	0.3%	Oct 25, 2026
28Monitor	CVE-2026-116066No exploit	Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Servicefirecrawl · firecrawl · CWE-918 Pre-auth SSRF	High7.0	—	0.2%	Oct 25, 2026
36Monitor	CVE-2026-116067Proof of concept	Paisa before 0.7.8 Path Traversal via Editor and Sheet APIananthakumaran · paisa · CWE-22 Pre-auth Path traversal	High8.8	—	1.6%	Oct 25, 2026
34Monitor	CVE-2026-116068No exploit	Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Routerdokploy · dokploy · CWE-639 Broken access control (IDOR)	High8.7	—	0.3%	Oct 25, 2026
27Monitor	CVE-2026-116070Proof of concept	Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/configdqzboy · docker-proxy · CWE-306 Pre-auth Auth bypass	Medium6.9	—	0.5%	Oct 25, 2026
32Monitor	CVE-2026-116071No exploit	rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryptionrotki · rotki · CWE-916 Pre-auth	High8.2	—	0.2%	Oct 25, 2026
28Monitor	CVE-2026-116149No exploit	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Imagesimagemagick · imagemagick · CWE-121 Memory safety	High7.2	—	0.3%	Oct 25, 2026
36Monitor	CVE-2026-116163No exploit	Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclassesparse-community · parse-server · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.2%	Oct 25, 2026
35Monitor	CVE-2026-116165No exploit	Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDBparse-community · parse-server · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 25, 2026
30Monitor	CVE-2026-116166No exploit	SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Settingsiyuan-note · siyuan · CWE-319 Pre-auth Weak crypto	High7.6	—	0.1%	Oct 25, 2026
30Monitor	CVE-2026-116167Proof of concept	SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parametersiyuan-note · siyuan · CWE-79 Pre-auth XSS	High7.6	—	0.6%	Oct 25, 2026
32Monitor	CVE-2026-116172No exploit	vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_nvllm · vllm · CWE-20 Pre-auth	High8.2	—	0.3%	Oct 25, 2026
32Monitor	CVE-2026-116173No exploit	vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_idsvllm · vllm · CWE-20 Pre-auth	High8.2	—	0.3%	Oct 25, 2026
32Monitor	CVE-2026-116174No exploit	vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generatevllm · vllm · CWE-20 Pre-auth	High8.2	—	0.2%	Oct 25, 2026
28Monitor	CVE-2026-116175No exploit	vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completionsvllm · vllm · CWE-409	High7.1	—	0.3%	Oct 25, 2026
35Monitor	CVE-2026-116176No exploit	vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnectorvllm · vllm · CWE-918 Pre-auth SSRF	High8.8	—	0.3%	Oct 25, 2026
34Monitor	CVE-2026-116177No exploit	vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypassvllm · vllm · CWE-400 Pre-auth Denial of service	High8.7	—	0.2%	Oct 25, 2026
32Monitor	CVE-2026-116178No exploit	vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholdersvllm · vllm · CWE-20 Pre-auth	High8.2	—	0.3%	Oct 25, 2026
34Monitor	CVE-2026-116179No exploit	vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Overridevllm · vllm · CWE-770 Pre-auth Denial of service	High8.7	—	0.3%	Oct 25, 2026
33Monitor	CVE-2026-116180No exploit	vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensorsvllm · vllm · CWE-908 Memory safety	High8.3	—	0.2%	Oct 25, 2026
28Monitor	CVE-2026-116181No exploit	vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_idsvllm · vllm · CWE-129	High7.1	—	0.3%	Oct 25, 2026
34Monitor	CVE-2026-116183No exploit	phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionIDthorsten · phpmyfaq · CWE-639 Pre-auth Broken access control (IDOR)	High8.7	—	0.2%	Oct 25, 2026
30Monitor	CVE-2026-116189No exploit	rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMSrclone · rclone · CWE-347 Pre-auth Weak crypto	High7.7	—	0.1%	Oct 25, 2026
34Monitor	CVE-2026-116191Proof of concept	Rclone before 1.75.2 Path Traversal via serve webdav MKCOLrclone · rclone · CWE-22 Pre-auth Path traversal	High8.7	—	0.3%	Oct 25, 2026
32Monitor	CVE-2026-116192No exploit	rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote rootsrclone · rclone · CWE-918 Pre-auth SSRF	High8.2	—	0.2%	Oct 25, 2026
30Monitor	CVE-2026-116194No exploit	Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callbackrclone · rclone · CWE-346 Pre-auth CSRF	High7.6	—	0.1%	Oct 25, 2026
28Monitor	CVE-2026-116195No exploit	Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trimrclone · rclone · CWE-22 Pre-auth Path traversal	High7.0	—	0.2%	Oct 25, 2026
36Monitor	CVE-2026-116199No exploit	Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callbacksnipeitapp · snipe-it · CWE-285 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.2	—	0.3%	Oct 25, 2026
32Monitor	CVE-2026-116200No exploit	Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()snipeitapp · snipe-it · CWE-319 Pre-auth Weak crypto	High8.2	—	0.1%	Oct 25, 2026
34Monitor	CVE-2026-116201No exploit	Snipe-IT before 8.5.0 SAML Assertion Replay via Race Conditionsnipeitapp · snipe-it · CWE-294 Auth bypass Race condition	High8.7	—	0.3%	Oct 25, 2026
28Monitor	CVE-2026-116204No exploit	YesWiki before 4.7.0 CSRF via despam Admin Actionyeswiki · yeswiki · CWE-352 Pre-auth CSRF	High7.2	—	0.1%	Oct 25, 2026
27Monitor	CVE-2026-116205Proof of concept	YesWiki before 4.7.0 Unauthenticated SSRF via [[\|URL]] Raw-Inclusion Syntaxyeswiki · yeswiki · CWE-918 Pre-auth SSRF	Medium6.9	—	0.5%	Oct 25, 2026
35Monitor	CVE-2026-116207No exploit	YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search APIyeswiki · yeswiki · CWE-89 Pre-auth SQL injection	High8.8	—	0.3%	Oct 25, 2026
28Monitor	CVE-2026-116208No exploit	YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPostsyeswiki · yeswiki · CWE-862 Pre-auth Broken access control (IDOR)	High7.2	—	0.2%	Oct 25, 2026
35Monitor	CVE-2026-116211No exploit	YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry createyeswiki · yeswiki · CWE-89 Pre-auth SQL injection	High8.8	—	0.2%	Oct 25, 2026
30Monitor	CVE-2026-115817No exploit	Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headersCWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Oct 25, 2026
30Monitor	CVE-2026-115822No exploit	Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodiesCWE-1333 Pre-auth Denial of service	High7.5	—	0.5%	Oct 25, 2026
36Monitor	CVE-2026-115823No exploit	Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connectionsCWE-444 Pre-auth	Critical9.1	—	0.3%	Oct 25, 2026
30Monitor	CVE-2026-115824No exploit	Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodiesCWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Oct 25, 2026
30Monitor	CVE-2026-115825No exploit	HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-LengthCWE-789 Pre-auth Denial of service	High7.5	—	0.6%	Oct 25, 2026
8Monitor	CVE-2026-116063Proof of concept	DedeCMS update_guide.php require_once code injectionCWE-74 RCE	Low2.0	—	0.2%	Oct 25, 2026
25Monitor	CVE-2026-116105Proof of concept	HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmissionCWE-310 Pre-auth	Medium6.3	—	0.2%	Oct 26, 2026
27Monitor	CVE-2026-116106Proof of concept	HeyCyan App FileProvider access controlCWE-266 Pre-auth	Medium6.9	—	0.3%	Oct 26, 2026
33Monitor	CVE-2026-116116No exploit	Yoosee GM8135S Camera Secure Boot signature verificationyoosee · gm8135s camera · CWE-345	High8.4	—	0.0%	Oct 26, 2026
34Monitor	CVE-2026-113345No exploit	Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an iministry of land, infrastructure, transport and tourism, japan · electronic delivery item inspection support system · CWE-276 RCE	High8.5	—	0.1%	Oct 26, 2026
33Monitor	CVE-2026-107894No exploit	V-SFT provided by FUJI ELECTRIC CO., LTD.fuji electric co., ltd. / hakko electronics co., ltd. · v-sft · CWE-121 RCE Memory safety	High8.4	—	0.1%	Oct 26, 2026
33Monitor	CVE-2026-107895No exploit	V-SFT provided by FUJI ELECTRIC CO., LTD.fuji electric co., ltd. / hakko electronics co., ltd. · v-sft · CWE-787 RCE Memory safety	High8.4	—	0.1%	Oct 26, 2026
33Monitor	CVE-2026-107896No exploit	V-SFT provided by FUJI ELECTRIC CO., LTD.fuji electric co., ltd. / hakko electronics co., ltd. · v-sft · CWE-125 RCE Memory safety	High8.4	—	0.1%	Oct 26, 2026
33Monitor	CVE-2026-107897No exploit	V-SFT provided by FUJI ELECTRIC CO., LTD.fuji electric co., ltd. / hakko electronics co., ltd. · v-sft · CWE-125 RCE Memory safety	High8.4	—	0.1%	Oct 26, 2026
33Monitor	CVE-2026-107898No exploit	V-SFT provided by FUJI ELECTRIC CO., LTD.fuji electric co., ltd. / hakko electronics co., ltd. · v-sft · CWE-125 RCE Memory safety	High8.4	—	0.1%	Oct 26, 2026
33Monitor	CVE-2026-107899No exploit	V-SFT provided by FUJI ELECTRIC CO., LTD.fuji electric co., ltd. / hakko electronics co., ltd. · v-sft · CWE-125 RCE Memory safety	High8.4	—	0.1%	Oct 26, 2026
33Monitor	CVE-2026-107900No exploit	V-SFT provided by FUJI ELECTRIC CO., LTD.fuji electric co., ltd. / hakko electronics co., ltd. · v-sft · CWE-125 RCE Memory safety	High8.4	—	0.1%	Oct 26, 2026
34Monitor	CVE-2026-116231No exploit	Oray Pugongying X5 Pro Ser2net crlf injectionoray · pugongying x5 pro · CWE-74	High8.6	—	0.4%	Oct 26, 2026
34Monitor	CVE-2026-116232No exploit	Oray Pugongying X5 Pro SNMP snmp_set crlf injectionoray · pugongying x5 pro · CWE-74	High8.6	—	0.4%	Oct 26, 2026
30Monitor	CVE-2026-96581No exploit	An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's recordsash-project · ash · CWE-639 Broken access control (IDOR)	High7.6	—	0.2%	Oct 26, 2026
21Monitor	CVE-2026-101259Proof of concept	Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptionsapache · camel · CWE-209 Pre-auth Info leak	Medium5.3	—	0.3%	Oct 26, 2026
35Monitor	CVE-2026-111841No exploit	WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityaman · funnelkit automations · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 26, 2026
34Monitor	CVE-2026-116233No exploit	Oray Pugongying X5 Pro Dnsmasq crlf injectionoray · pugongying x5 pro · CWE-74	High8.5	—	0.4%	Oct 26, 2026

CVE-2026-115895
35Monitor
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
capricorn86 · happy-domOct 23, 2026
CVE-2026-115935
34Monitor
Control panel only API response emulation replaces "securityKey" and reaches server RCE
HighCVSS 8.7No exploitEPSS 0%
- RCE
craftcms · cmsOct 23, 2026
CVE-2026-115937
34Monitor
Unauthenticated payment reuse allows unpaid orders to be marked as paid
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
craftcms · commerce-mollieOct 23, 2026
CVE-2026-115938
34Monitor
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
HighCVSS 8.7No exploitEPSS 0%
- RCE
- SSTI
craftcms · cmsOct 23, 2026
CVE-2026-115931
39Monitor
Arbitrary file read and backend crash through unrestricted provider method calls
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
gitroomhq · postiz-appOct 23, 2026
CVE-2026-115929
30Monitor
MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Weak crypto
mongodb, inc. · compassOct 24, 2026
CVE-2026-115806
39Monitor
Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
codexonics · prime mover – backup and migrationOct 24, 2026
CVE-2026-115807
28Monitor
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via G
HighCVSS 7.1No exploitEPSS 0%
cozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editorOct 24, 2026
CVE-2026-110956
39Monitor
asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · asvereinbaseOct 24, 2026
CVE-2026-112207
28Monitor
Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
HighCVSS 7.1No exploitEPSS 0%
- pre-auth RCE
- XSS
unknown · download monitorOct 24, 2026
CVE-2026-113673
28Monitor
GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
HighCVSS 7.2No exploitEPSS 0%
- RCE
unknown · geodirectoryOct 24, 2026
CVE-2026-111402
37Monitor
WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
tribulant software · newslettersOct 24, 2026
CVE-2026-112844
28Monitor
WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
arraytics · wp event solutionOct 24, 2026
CVE-2026-112866
37Monitor
WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
wpfactory · product filter by wbwOct 24, 2026
CVE-2026-112869
28Monitor
WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
noah hearle · we’re open!Oct 24, 2026
CVE-2026-114178
28Monitor
WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bold grid · w3 total cacheOct 24, 2026
CVE-2026-114179
28Monitor
WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wordplus · bp better messagesOct 24, 2026
CVE-2026-114196
39Monitor
WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
paytiumsupport · paytiumOct 24, 2026
CVE-2026-114694
28Monitor
WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
pixelite · events managerOct 24, 2026
CVE-2026-114695
28Monitor
WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
infomaniak network · vod infomaniakOct 24, 2026
CVE-2026-114697
28Monitor
WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
quarka · qa analyticsOct 24, 2026
CVE-2026-115975
28Monitor
Broken access control in JiraController
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
cervantessec · cervantesOct 24, 2026
CVE-2026-94075
39Monitor
WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
tribulant software · newslettersOct 24, 2026
CVE-2026-110018
35Monitor
aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
HighCVSS 8.8No exploitEPSS 0%
kodezen · ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builderOct 24, 2026
CVE-2026-116009
34Monitor
Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
owen2345 · camaleon-cmsOct 24, 2026
CVE-2026-116011
34Monitor
Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
crowcpp · crowOct 24, 2026
CVE-2026-116012
8Monitor
Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
LowCVSS 2.0Proof of conceptEPSS 0%
nationalsecurityagency · ghidraOct 24, 2026
CVE-2026-116014
36Monitor
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Memory safety
open62541 · open62541Oct 24, 2026
CVE-2026-116016
28Monitor
yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
HighCVSS 7.1No exploitEPSS 0%
yunaiv · yudao-cloudOct 24, 2026
CVE-2026-116019
34Monitor
Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
HighCVSS 8.7No exploitEPSS 0%
getgrav · gravOct 24, 2026
CVE-2026-115932
38Monitor
Path traversal in post media lets any registered user read server files
CriticalCVSS 9.6No exploitEPSS 0%
- Path traversal
gitroomhq · postiz-appOct 24, 2026
CVE-2026-114191
30Monitor
WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
knit pay · upi qr code payment gateway for woocommerceOct 24, 2026
CVE-2026-114629
30Monitor
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 24, 2026
CVE-2026-114704
28Monitor
WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
christoph vielgrader · relevanssiOct 24, 2026
CVE-2026-115557
37Monitor
Distrust compromised intermediate certificates in ssl module
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
python software foundation · cpythonOct 24, 2026
CVE-2026-115933
39Monitor
Forged signed tokens let any registered user take over other users and organizations
CriticalCVSS 9.9No exploitEPSS 0%
- Auth bypass
gitroomhq · postiz-appOct 24, 2026
CVE-2026-114820
36Monitor
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
oracle corporation · oracle java seOct 24, 2026
CVE-2026-115995
37Monitor
Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection
CriticalCVSS 9.4No exploitEPSS 1%
- pre-auth RCE
- Command injection
unitree robotics · unitree go2Oct 24, 2026
CVE-2026-116000
22Monitor
Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery
MediumCVSS 5.5Proof of conceptEPSS 0%
- Pre-auth
- SSRF
zylon · privategptOct 25, 2026
CVE-2026-116004
8Monitor
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
LowCVSS 2.0Proof of conceptEPSS 0%
- XSS
onyx-dot-app · onyxOct 25, 2026
CVE-2026-116006
22Monitor
YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
MediumCVSS 5.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
yunaiv · ruoyi-vue-proOct 25, 2026
CVE-2026-115214
39Monitor
Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · datawiza proxy auth pluginOct 25, 2026
CVE-2026-115251
28Monitor
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade
HighCVSS 7.2No exploitEPSS 0%
- Auth bypass
unknown · duplicatorOct 25, 2026
CVE-2026-116066
28Monitor
Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- SSRF
firecrawl · firecrawlOct 25, 2026
CVE-2026-116067
36Monitor
Paisa before 0.7.8 Path Traversal via Editor and Sheet API
HighCVSS 8.8Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
ananthakumaran · paisaOct 25, 2026
CVE-2026-116068
34Monitor
Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
dokploy · dokployOct 25, 2026
CVE-2026-116070
27Monitor
Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
dqzboy · docker-proxyOct 25, 2026
CVE-2026-116071
32Monitor
rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
rotki · rotkiOct 25, 2026
CVE-2026-116149
28Monitor
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images
HighCVSS 7.2No exploitEPSS 0%
- Memory safety
imagemagick · imagemagickOct 25, 2026
CVE-2026-116163
36Monitor
Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
parse-community · parse-serverOct 25, 2026
CVE-2026-116165
35Monitor
Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
parse-community · parse-serverOct 25, 2026
CVE-2026-116166
30Monitor
SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Weak crypto
siyuan-note · siyuanOct 25, 2026
CVE-2026-116167
30Monitor
SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
HighCVSS 7.6Proof of conceptEPSS 0%
- Pre-auth
- XSS
siyuan-note · siyuanOct 25, 2026
CVE-2026-116172
32Monitor
vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
vllm · vllmOct 25, 2026
CVE-2026-116173
32Monitor
vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
vllm · vllmOct 25, 2026
CVE-2026-116174
32Monitor
vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
vllm · vllmOct 25, 2026
CVE-2026-116175
28Monitor
vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
HighCVSS 7.1No exploitEPSS 0%
vllm · vllmOct 25, 2026
CVE-2026-116176
35Monitor
vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SSRF
vllm · vllmOct 25, 2026
CVE-2026-116177
34Monitor
vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
vllm · vllmOct 25, 2026
CVE-2026-116178
32Monitor
vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
vllm · vllmOct 25, 2026
CVE-2026-116179
34Monitor
vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
vllm · vllmOct 25, 2026
CVE-2026-116180
33Monitor
vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
HighCVSS 8.3No exploitEPSS 0%
- Memory safety
vllm · vllmOct 25, 2026
CVE-2026-116181
28Monitor
vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids
HighCVSS 7.1No exploitEPSS 0%
vllm · vllmOct 25, 2026
CVE-2026-116183
34Monitor
phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
thorsten · phpmyfaqOct 25, 2026
CVE-2026-116189
30Monitor
rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
rclone · rcloneOct 25, 2026
CVE-2026-116191
34Monitor
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
rclone · rcloneOct 25, 2026
CVE-2026-116192
32Monitor
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
rclone · rcloneOct 25, 2026
CVE-2026-116194
30Monitor
Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- CSRF
rclone · rcloneOct 25, 2026
CVE-2026-116195
28Monitor
Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Path traversal
rclone · rcloneOct 25, 2026
CVE-2026-116199
36Monitor
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
snipeitapp · snipe-itOct 25, 2026
CVE-2026-116200
32Monitor
Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
snipeitapp · snipe-itOct 25, 2026
CVE-2026-116201
34Monitor
Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
- Race condition
snipeitapp · snipe-itOct 25, 2026
CVE-2026-116204
28Monitor
YesWiki before 4.7.0 CSRF via despam Admin Action
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- CSRF
yeswiki · yeswikiOct 25, 2026
CVE-2026-116205
27Monitor
YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- SSRF
yeswiki · yeswikiOct 25, 2026
CVE-2026-116207
35Monitor
YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SQL injection
yeswiki · yeswikiOct 25, 2026
CVE-2026-116208
28Monitor
YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
yeswiki · yeswikiOct 25, 2026
CVE-2026-116211
35Monitor
YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SQL injection
yeswiki · yeswikiOct 25, 2026
CVE-2026-115817
30Monitor
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 25, 2026
CVE-2026-115822
30Monitor
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 25, 2026
CVE-2026-115823
36Monitor
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 25, 2026
CVE-2026-115824
30Monitor
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 25, 2026
CVE-2026-115825
30Monitor
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 25, 2026
CVE-2026-116063
8Monitor
DedeCMS update_guide.php require_once code injection
LowCVSS 2.0Proof of conceptEPSS 0%
- RCE
Oct 25, 2026
CVE-2026-116105
25Monitor
HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
MediumCVSS 6.3Proof of conceptEPSS 0%
- Pre-auth
Oct 26, 2026
CVE-2026-116106
27Monitor
HeyCyan App FileProvider access control
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
Oct 26, 2026
CVE-2026-116116
33Monitor
Yoosee GM8135S Camera Secure Boot signature verification
HighCVSS 8.4No exploitEPSS 0%
yoosee · gm8135s cameraOct 26, 2026
CVE-2026-113345
34Monitor
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an i
HighCVSS 8.5No exploitEPSS 0%
- RCE
ministry of land, infrastructure, transport and tourism, japan · electronic delivery item inspection support systemOct 26, 2026
CVE-2026-107894
33Monitor
V-SFT provided by FUJI ELECTRIC CO., LTD.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
fuji electric co., ltd. / hakko electronics co., ltd. · v-sftOct 26, 2026
CVE-2026-107895
33Monitor
V-SFT provided by FUJI ELECTRIC CO., LTD.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
fuji electric co., ltd. / hakko electronics co., ltd. · v-sftOct 26, 2026
CVE-2026-107896
33Monitor
V-SFT provided by FUJI ELECTRIC CO., LTD.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
fuji electric co., ltd. / hakko electronics co., ltd. · v-sftOct 26, 2026
CVE-2026-107897
33Monitor
V-SFT provided by FUJI ELECTRIC CO., LTD.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
fuji electric co., ltd. / hakko electronics co., ltd. · v-sftOct 26, 2026
CVE-2026-107898
33Monitor
V-SFT provided by FUJI ELECTRIC CO., LTD.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
fuji electric co., ltd. / hakko electronics co., ltd. · v-sftOct 26, 2026
CVE-2026-107899
33Monitor
V-SFT provided by FUJI ELECTRIC CO., LTD.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
fuji electric co., ltd. / hakko electronics co., ltd. · v-sftOct 26, 2026
CVE-2026-107900
33Monitor
V-SFT provided by FUJI ELECTRIC CO., LTD.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
fuji electric co., ltd. / hakko electronics co., ltd. · v-sftOct 26, 2026
CVE-2026-116231
34Monitor
Oray Pugongying X5 Pro Ser2net crlf injection
HighCVSS 8.6No exploitEPSS 0%
oray · pugongying x5 proOct 26, 2026
CVE-2026-116232
34Monitor
Oray Pugongying X5 Pro SNMP snmp_set crlf injection
HighCVSS 8.6No exploitEPSS 0%
oray · pugongying x5 proOct 26, 2026
CVE-2026-96581
30Monitor
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
ash-project · ashOct 26, 2026
CVE-2026-101259
21Monitor
Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apache · camelOct 26, 2026
CVE-2026-111841
35Monitor
WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
aman · funnelkit automationsOct 26, 2026
CVE-2026-116233
34Monitor
Oray Pugongying X5 Pro Dnsmasq crlf injection
HighCVSS 8.5No exploitEPSS 0%
oray · pugongying x5 proOct 26, 2026