By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 75 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-116818No exploit	OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocketopenpanel-dev · openpanel · CWE-89 Pre-auth SQL injection	High8.8	—	0.4%	Oct 27, 2026
33Monitor	CVE-2026-116819No exploit	OpenPanel before 3.0.0 Credential Disclosure via notification.rules Queryopenpanel-dev · openpanel · CWE-200 Info leak	High8.4	—	0.3%	Oct 27, 2026
28Monitor	CVE-2026-116821No exploit	YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernamesyeswiki · yeswiki · CWE-89 SQL injection	High7.1	—	0.2%	Oct 27, 2026
33Monitor	CVE-2026-116825No exploit	YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inboxyeswiki · yeswiki · CWE-294 Pre-auth Auth bypass	High8.3	—	0.2%	Oct 27, 2026
32Monitor	CVE-2026-116826No exploit	YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFileyeswiki · yeswiki · CWE-918 SSRF	High8.2	—	0.2%	Oct 27, 2026
32Monitor	CVE-2026-116827No exploit	YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Importyeswiki · yeswiki · CWE-918 SSRF	High8.2	—	0.3%	Oct 27, 2026
35Monitor	CVE-2024-58400No exploit	llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDsggml-org · llama.cpp · CWE-129 Pre-auth	High8.8	—	0.4%	Oct 27, 2026
34Monitor	CVE-2026-116816No exploit	llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizerggml-org · llama.cpp · CWE-129	High8.5	—	0.1%	Oct 27, 2026
35Monitor	CVE-2026-116836No exploit	A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulneraubiquiti inc · airmax m · CWE-79 Pre-auth XSS	High8.8	—	0.1%	Oct 27, 2026
35Monitor	CVE-2026-116837No exploit	A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, Solarubiquiti inc · airmax m · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-116838No exploit	A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found ubiquiti inc · airmax m · CWE-352 pre-auth RCE Command injection CSRF	High8.8	—	0.3%	Oct 27, 2026
28Monitor	CVE-2026-116839No exploit	A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found ubiquiti inc · airmax m · CWE-352 Pre-auth CSRF	High7.1	—	0.1%	Oct 27, 2026
34Monitor	CVE-2026-116843No exploit	Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Modemistralai · mistral-vibe · CWE-829 pre-auth RCE	High8.7	—	0.4%	Oct 27, 2026
28Monitor	CVE-2026-111820No exploit	Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Titledeconf · analytics insights – google analytics dashboard for wordpress · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 27, 2026
30Monitor	CVE-2026-106174No exploit	A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network afortinet · fortios · CWE-667 Pre-auth Denial of service	High7.5	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-75891No exploit	Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpointthemeum · kirki – freeform page builder, website builder & customizer · CWE-502 Deserialization	High8.8	—	0.3%	Oct 27, 2026
30Monitor	CVE-2026-111459No exploit	Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)moxa · moxa remote connect suite (mrc client) · CWE-295 Pre-auth Weak crypto	High7.6	—	0.1%	Oct 27, 2026
30Monitor	CVE-2026-111460No exploit	Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Seriesmoxa · oncell g3150a-lte series · CWE-321 Pre-auth Hard-coded credentials	High7.7	—	0.3%	Oct 27, 2026
30Monitor	CVE-2026-111461No exploit	SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Seriesmoxa · oncell g3150a-lte series · CWE-78 RCE Command injection	High7.5	—	1.3%	Oct 27, 2026
28Monitor	CVE-2026-16521No exploit	Supermicro BMC's syslog feature contains a command injection vulnerabilitysmci · mbd-x12stw-f · CWE-78 RCE Command injection	High7.2	—	0.8%	Oct 27, 2026
30Monitor	CVE-2026-18449No exploit	Supermicro BMC contains a SMCRAKP Fixed Key vulnerabilitysmci · x12spi · CWE-798 pre-auth RCE Hard-coded credentials	High7.5	—	0.3%	Oct 27, 2026
39Monitor	CVE-2026-18450No exploit	Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerabilitysmci · x12spi · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	0.4%	Oct 27, 2026
29Monitor	CVE-2026-65219No exploit	Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerabilitysmci · mbd-x12spi · CWE-696 Pre-auth	High7.4	—	0.4%	Oct 27, 2026
35Monitor	CVE-2026-65220No exploit	Supermicro BMC IPMI feature contains a Privilege escalation vulnerabilitysmci · mbd-x12spi · CWE-269	High8.8	—	0.2%	Oct 27, 2026
28Monitor	CVE-2026-65211No exploit	Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerabilitysmci · mbd-x12spi · CWE-287 Auth bypass	High7.2	—	0.3%	Oct 27, 2026
39Monitor	CVE-2026-92885No exploit	Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Loginqode themes · qode membership · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 27, 2026
37Monitor	CVE-2026-102788No exploit	Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2balbooa.com · gridbox extension for joomla · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 27, 2026
37Monitor	CVE-2026-102789No exploit	Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2balbooa.com · gridbox extension for joomla · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.3%	Oct 27, 2026
33Monitor	CVE-2026-117493No exploit	Multiple vulnerabilities in Sisense’s Cloud BI Platformsisense · cloud bi platform · CWE-79 XSS	High8.3	—	0.2%	Oct 27, 2026
37Monitor	CVE-2026-76932No exploit	Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-121 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
37Monitor	CVE-2026-76933No exploit	Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-122 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
39Monitor	CVE-2026-76934No exploit	Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-121 Pre-auth Memory safety	Critical9.8	—	0.5%	Oct 27, 2026
37Monitor	CVE-2026-76935No exploit	Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-121 Pre-auth Memory safety	Critical9.4	—	0.3%	Oct 27, 2026
37Monitor	CVE-2026-76936No exploit	Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-121 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
37Monitor	CVE-2026-76937No exploit	Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-122 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
39Monitor	CVE-2026-76938No exploit	Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-290 Pre-auth Auth bypass	Critical9.8	—	0.6%	Oct 27, 2026
39Monitor	CVE-2026-76939No exploit	Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3hitachi · jp1/automatic job management system 3 - manager · CWE-122 Pre-auth Memory safety	Critical9.8	—	0.5%	Oct 27, 2026
39Monitor	CVE-2026-82116No exploit	Missing Authentication for Critical Function Vulnerability in HiRDBhitachi · hirdb server version 10 · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.6%	Oct 27, 2026
39Monitor	CVE-2026-82117No exploit	Authentication Bypass by Spoofing Vulnerability in HiRDBhitachi · hirdb server version 10 · CWE-290 Pre-auth Auth bypass	Critical9.8	—	0.6%	Oct 27, 2026
39Monitor	CVE-2026-82118No exploit	Stack-based Buffer Overflow Vulnerability in HiRDBhitachi · hirdb server version 10 · CWE-121 Pre-auth Memory safety	Critical9.8	—	0.5%	Oct 27, 2026
39Monitor	CVE-2026-82119No exploit	OS Command Injection Vulnerability in HiRDBhitachi · hirdb server version 10 · CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.0%	Oct 27, 2026
39Monitor	CVE-2026-82120No exploit	Heap-based Buffer Overflow Vulnerability in HiRDBhitachi · hirdb server version 10 · CWE-122 Pre-auth Memory safety	Critical9.8	—	0.3%	Oct 27, 2026
30Monitor	CVE-2026-82121No exploit	Origin Validation Error Vulnerability in HiRDBhitachi · hirdb server version 10 · CWE-346 Pre-auth	High7.5	—	0.2%	Oct 27, 2026
37Monitor	CVE-2026-82122No exploit	Stack-based Buffer Overflow Vulnerability in HiRDBhitachi · hirdb server version 10 · CWE-121 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
33Monitor	CVE-2026-85299No exploit	Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltrationgoogle cloud · compute engine · CWE-862 Broken access control (IDOR)	High8.3	—	0.2%	Oct 27, 2026
39Monitor	CVE-2026-86574No exploit	Heap-based Buffer Overflow Vulnerability in JP1/Basehitachi · jp1/base · CWE-122 Pre-auth Memory safety	Critical9.8	—	0.5%	Oct 27, 2026
37Monitor	CVE-2026-86575No exploit	Stack-based Buffer Overflow Vulnerability in JP1 Productshitachi · jp1/integrated management 3 - manager · CWE-121 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
37Monitor	CVE-2026-86576No exploit	Heap-based Buffer Overflow Vulnerability in JP1 Productshitachi · jp1/integrated management 3 - manager · CWE-122 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
37Monitor	CVE-2026-86577No exploit	Out-of-bounds Write Vulnerability in JP1 Productshitachi · jp1/integrated management 3 - manager · CWE-787 Pre-auth Memory safety	Critical9.4	—	0.4%	Oct 27, 2026
34Monitor	CVE-2026-116870No exploit	In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.octopus deploy · octopus server · CWE-1289	High8.7	—	0.2%	Oct 27, 2026
34Monitor	CVE-2026-116871No exploit	Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Asksemantic-mediawiki · semantic mediawiki · CWE-674 Pre-auth Denial of service	High8.7	—	0.3%	Oct 27, 2026
34Monitor	CVE-2026-116872No exploit	Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filterssemantic-mediawiki · semantic mediawiki · CWE-407 Pre-auth	High8.7	—	0.3%	Oct 27, 2026
28Monitor	CVE-2026-116876No exploit	Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protectedsemantic-mediawiki · semantic mediawiki · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 27, 2026
34Monitor	CVE-2026-116877No exploit	Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_eventsemantic-mediawiki · semantic mediawiki · CWE-770 Pre-auth Denial of service	High8.7	—	0.3%	Oct 27, 2026
34Monitor	CVE-2026-116878No exploit	Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilaritysemantic-mediawiki · semantic mediawiki · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Oct 27, 2026
28Monitor	CVE-2026-116880No exploit	Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actionssemantic-mediawiki · semantic mediawiki · CWE-352 Pre-auth CSRF	High7.1	—	0.1%	Oct 27, 2026
30Monitor	CVE-2026-116896No exploit	REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tablesredaxo · core · CWE-862 Broken access control (IDOR)	High7.7	—	0.2%	Oct 27, 2026
28Monitor	CVE-2026-116897No exploit	REDAXO before 5.21.4 Missing Authorization in Version and History Previewsredaxo · core · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 27, 2026
28Monitor	CVE-2026-116898No exploit	REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Moveredaxo · core · CWE-639 Broken access control (IDOR)	High7.1	—	0.1%	Oct 27, 2026
28Monitor	CVE-2026-116899No exploit	REDAXO before 5.21.4 Broken Access Control in Slice Operationsredaxo · core · CWE-639 Broken access control (IDOR)	High7.1	—	0.1%	Oct 27, 2026
30Monitor	CVE-2026-117341No exploit	In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log.octopus deploy · octopus server · CWE-532 Info leak	High7.7	—	0.2%	Oct 27, 2026
34Monitor	CVE-2026-117466No exploit	In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.octopus deploy · octopus server · CWE-269	High8.6	—	0.2%	Oct 27, 2026
37Monitor	CVE-2026-117532Proof of concept	REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Pluginredaxo · core · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.6%	Oct 27, 2026
34Monitor	CVE-2026-117536No exploit	REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalationredaxo · core · CWE-352 Pre-auth CSRF	High8.6	—	0.1%	Oct 27, 2026
34Monitor	CVE-2026-117540No exploit	svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loopdarylldoyle · svg-sanitizer · CWE-407 Pre-auth	High8.7	—	0.3%	Oct 27, 2026
34Monitor	CVE-2026-102800No exploit	Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0dj-extensions.com · dj-helpfularticles extension for joomla · CWE-79 Pre-auth Auth bypass XSS	High8.7	—	0.3%	Oct 27, 2026
34Monitor	CVE-2026-106087No exploit	TRO600 contains an arbitrary file read vulnerability.hitachi energy · tro600 series firmware · CWE-306 Pre-auth Auth bypass	High8.7	—	0.2%	Oct 27, 2026
28Monitor	CVE-2026-109995No exploit	Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Contentwplakeorg · advanced views – display framework – gutenberg/elementor/shortcode · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 27, 2026
30Monitor	CVE-2026-10756No exploit	TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to hitachi energy · tro600 series firmware · CWE-923	High7.7	—	0.1%	Oct 27, 2026
36Monitor	CVE-2026-112362No exploit	@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets@fastify/express · @fastify/express · CWE-436 Pre-auth	Critical9.1	—	0.3%	Oct 27, 2026
36Monitor	CVE-2026-115216No exploit	Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentialseclipse foundation · eclipse iofog · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.2%	Oct 27, 2026
30Monitor	CVE-2026-13162No exploit	An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commandhitachi energy · coretec 5 · CWE-78 RCE Command injection	High7.7	—	0.1%	Oct 27, 2026
30Monitor	CVE-2026-41020No exploit	Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authenticationeaton · easye4 · CWE-294 Pre-auth Auth bypass	High7.5	—	0.2%	Oct 27, 2026
30Monitor	CVE-2026-41021No exploit	Eaton easyE4 uses an insufficiently strong password policy.eaton · easye4 · CWE-521 Pre-auth	High7.5	—	0.1%	Oct 27, 2026
35Monitor	CVE-2026-4337No exploit	Unrestricted Upload of File in PuMuKIT applicationpumukit · pumukit · CWE-434 Pre-auth File upload	High8.8	—	0.3%	Oct 27, 2026
30Monitor	CVE-2026-100164No exploit	User Enumeration in Rolantis Information Technologies' Agentisrolantis information technologies tourism industry and trade co. ltd. · agentis · CWE-204 Pre-auth	High7.5	—	0.3%	Oct 27, 2026
34Monitor	CVE-2026-116627No exploit	Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell devolutions · powershell universal · CWE-79 RCE XSS	High8.7	—	0.1%	Oct 27, 2026
28Monitor	CVE-2026-24269No exploit	NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.nvidia · tensorrt-llm · CWE-918 SSRF	High7.1	—	0.1%	Oct 27, 2026
31Monitor	CVE-2026-47486No exploit	NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write.nvidia · physx · CWE-787 Memory safety	High7.8	—	0.1%	Oct 27, 2026
33Monitor	CVE-2026-65119No exploit	NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusinvidia · tensorrt-llm · CWE-829	High8.4	—	0.1%	Oct 27, 2026
28Monitor	CVE-2026-65120No exploit	NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.nvidia · tensorrt-llm · CWE-918 SSRF	High7.1	—	0.1%	Oct 27, 2026
40Plan	CVE-2026-65145No exploit	NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue.nvidia · nemo agent toolkit · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.5%	Oct 27, 2026
33Monitor	CVE-2026-65151No exploit	NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue.nvidia · nemo agent toolkit · CWE-89 SQL injection	High8.4	—	0.1%	Oct 27, 2026
30Monitor	CVE-2026-92546No exploit	Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Allykeepnet labs cybersecurity inc. · agentic ai / agentic ally · CWE-290 Pre-auth Auth bypass	High7.5	—	0.3%	Oct 27, 2026
30Monitor	CVE-2026-117553No exploit	Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoningumbraco · umbraco-cms · CWE-601 Pre-auth Auth bypass Open redirect	High7.7	—	0.4%	Oct 27, 2026
34Monitor	CVE-2026-117558No exploit	ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_statusai-sdlc-framework · ai-sdlc · CWE-78 RCE Command injection	High8.5	—	0.6%	Oct 27, 2026
34Monitor	CVE-2026-117559No exploit	DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypasshyperb1iss · droidmind · CWE-78 RCE Command injection	High8.5	—	0.6%	Oct 27, 2026
34Monitor	CVE-2026-117560No exploit	ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Toolsatxp · gemini-cli-extension · CWE-78 RCE Command injection	High8.5	—	0.6%	Oct 27, 2026
34Monitor	CVE-2026-117561Proof of concept	sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Valuescodefriar · sf-mcp · CWE-78 RCE Command injection	High8.5	—	0.6%	Oct 27, 2026
37Monitor	CVE-2026-117564No exploit	nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secretbuqiyuan · nest-admin · CWE-321 Pre-auth Auth bypass Hard-coded credentials	Critical9.3	—	0.5%	Oct 27, 2026
34Monitor	CVE-2026-117567No exploit	esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parametershorw · esp-mcp · CWE-78 RCE Command injection	High8.5	—	0.6%	Oct 27, 2026
29Monitor	CVE-2026-117568No exploit	mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDirbitscorp-mcp · mcp-ffmpeg · CWE-78 RCE Command injection	High7.3	—	0.5%	Oct 27, 2026
34Monitor	CVE-2026-117569No exploit	Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parametersalishahid74 · kali-gpt · CWE-78 RCE Command injection	High8.5	—	0.6%	Oct 27, 2026
34Monitor	CVE-2026-117573No exploit	hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Toolsmasc-ucsc · hagent · CWE-78 RCE Command injection	High8.5	—	0.7%	Oct 27, 2026
37Monitor	CVE-2026-117601No exploit	Electrum before 4.8.3 Missing Signature Verification of Mempool Transactionsspesmilo · electrum · CWE-347 Pre-auth Weak crypto	Critical9.3	—	0.1%	Oct 27, 2026
34Monitor	CVE-2026-117602No exploit	Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Executionspesmilo · electrum · CWE-347 RCE Weak crypto	High8.6	—	0.1%	Oct 27, 2026
37Monitor	CVE-2026-117603No exploit	Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypassspesmilo · electrum · CWE-367 Pre-auth Race condition	Critical9.3	—	0.1%	Oct 27, 2026
32Monitor	CVE-2026-117860No exploit	Same-origin policy bypass in the DOM: Navigation componentmozilla · firefox · CWE-346 Pre-auth	High8.1	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-117861No exploit	Sandbox escape in the DOM: Navigation componentmozilla · firefox · CWE-693 Pre-auth	Critical9.6	—	0.3%	Oct 27, 2026
39Monitor	CVE-2026-117862No exploit	Privilege escalation due to incorrect boundary conditions in the Networking componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.5%	Oct 27, 2026

CVE-2026-116818
35Monitor
OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SQL injection
openpanel-dev · openpanelOct 27, 2026
CVE-2026-116819
33Monitor
OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
HighCVSS 8.4No exploitEPSS 0%
- Info leak
openpanel-dev · openpanelOct 27, 2026
CVE-2026-116821
28Monitor
YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
yeswiki · yeswikiOct 27, 2026
CVE-2026-116825
33Monitor
YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
yeswiki · yeswikiOct 27, 2026
CVE-2026-116826
32Monitor
YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
HighCVSS 8.2No exploitEPSS 0%
- SSRF
yeswiki · yeswikiOct 27, 2026
CVE-2026-116827
32Monitor
YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
HighCVSS 8.2No exploitEPSS 0%
- SSRF
yeswiki · yeswikiOct 27, 2026
CVE-2024-58400
35Monitor
llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
ggml-org · llama.cppOct 27, 2026
CVE-2026-116816
34Monitor
llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
HighCVSS 8.5No exploitEPSS 0%
ggml-org · llama.cppOct 27, 2026
CVE-2026-116836
35Monitor
A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnera
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
ubiquiti inc · airmax mOct 27, 2026
CVE-2026-116837
35Monitor
A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, Solar
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ubiquiti inc · airmax mOct 27, 2026
CVE-2026-116838
35Monitor
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
- CSRF
ubiquiti inc · airmax mOct 27, 2026
CVE-2026-116839
28Monitor
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
ubiquiti inc · airmax mOct 27, 2026
CVE-2026-116843
34Monitor
Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
mistralai · mistral-vibeOct 27, 2026
CVE-2026-111820
28Monitor
Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
deconf · analytics insights – google analytics dashboard for wordpressOct 27, 2026
CVE-2026-106174
30Monitor
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
fortinet · fortiosOct 27, 2026
CVE-2026-75891
35Monitor
Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
themeum · kirki – freeform page builder, website builder & customizerOct 27, 2026
CVE-2026-111459
30Monitor
Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Weak crypto
moxa · moxa remote connect suite (mrc client)Oct 27, 2026
CVE-2026-111460
30Monitor
Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
moxa · oncell g3150a-lte seriesOct 27, 2026
CVE-2026-111461
30Monitor
SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
HighCVSS 7.5No exploitEPSS 1%
- RCE
- Command injection
moxa · oncell g3150a-lte seriesOct 27, 2026
CVE-2026-16521
28Monitor
Supermicro BMC's syslog feature contains a command injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Command injection
smci · mbd-x12stw-fOct 27, 2026
CVE-2026-18449
30Monitor
Supermicro BMC contains a SMCRAKP Fixed Key vulnerability
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Hard-coded credentials
smci · x12spiOct 27, 2026
CVE-2026-18450
39Monitor
Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
smci · x12spiOct 27, 2026
CVE-2026-65219
29Monitor
Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
smci · mbd-x12spiOct 27, 2026
CVE-2026-65220
35Monitor
Supermicro BMC IPMI feature contains a Privilege escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
smci · mbd-x12spiOct 27, 2026
CVE-2026-65211
28Monitor
Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Auth bypass
smci · mbd-x12spiOct 27, 2026
CVE-2026-92885
39Monitor
Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
qode themes · qode membershipOct 27, 2026
CVE-2026-102788
37Monitor
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
balbooa.com · gridbox extension for joomlaOct 27, 2026
CVE-2026-102789
37Monitor
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
balbooa.com · gridbox extension for joomlaOct 27, 2026
CVE-2026-117493
33Monitor
Multiple vulnerabilities in Sisense’s Cloud BI Platform
HighCVSS 8.3No exploitEPSS 0%
- XSS
sisense · cloud bi platformOct 27, 2026
CVE-2026-76932
37Monitor
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-76933
37Monitor
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-76934
39Monitor
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-76935
37Monitor
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-76936
37Monitor
Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-76937
37Monitor
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-76938
39Monitor
Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-76939
39Monitor
Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/automatic job management system 3 - managerOct 27, 2026
CVE-2026-82116
39Monitor
Missing Authentication for Critical Function Vulnerability in HiRDB
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
hitachi · hirdb server version 10Oct 27, 2026
CVE-2026-82117
39Monitor
Authentication Bypass by Spoofing Vulnerability in HiRDB
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
hitachi · hirdb server version 10Oct 27, 2026
CVE-2026-82118
39Monitor
Stack-based Buffer Overflow Vulnerability in HiRDB
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · hirdb server version 10Oct 27, 2026
CVE-2026-82119
39Monitor
OS Command Injection Vulnerability in HiRDB
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
hitachi · hirdb server version 10Oct 27, 2026
CVE-2026-82120
39Monitor
Heap-based Buffer Overflow Vulnerability in HiRDB
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · hirdb server version 10Oct 27, 2026
CVE-2026-82121
30Monitor
Origin Validation Error Vulnerability in HiRDB
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
hitachi · hirdb server version 10Oct 27, 2026
CVE-2026-82122
37Monitor
Stack-based Buffer Overflow Vulnerability in HiRDB
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · hirdb server version 10Oct 27, 2026
CVE-2026-85299
33Monitor
Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
google cloud · compute engineOct 27, 2026
CVE-2026-86574
39Monitor
Heap-based Buffer Overflow Vulnerability in JP1/Base
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/baseOct 27, 2026
CVE-2026-86575
37Monitor
Stack-based Buffer Overflow Vulnerability in JP1 Products
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/integrated management 3 - managerOct 27, 2026
CVE-2026-86576
37Monitor
Heap-based Buffer Overflow Vulnerability in JP1 Products
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/integrated management 3 - managerOct 27, 2026
CVE-2026-86577
37Monitor
Out-of-bounds Write Vulnerability in JP1 Products
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
hitachi · jp1/integrated management 3 - managerOct 27, 2026
CVE-2026-116870
34Monitor
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.
HighCVSS 8.7No exploitEPSS 0%
octopus deploy · octopus serverOct 27, 2026
CVE-2026-116871
34Monitor
Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
semantic-mediawiki · semantic mediawikiOct 27, 2026
CVE-2026-116872
34Monitor
Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
semantic-mediawiki · semantic mediawikiOct 27, 2026
CVE-2026-116876
28Monitor
Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
semantic-mediawiki · semantic mediawikiOct 27, 2026
CVE-2026-116877
34Monitor
Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
semantic-mediawiki · semantic mediawikiOct 27, 2026
CVE-2026-116878
34Monitor
Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
semantic-mediawiki · semantic mediawikiOct 27, 2026
CVE-2026-116880
28Monitor
Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
semantic-mediawiki · semantic mediawikiOct 27, 2026
CVE-2026-116896
30Monitor
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
redaxo · coreOct 27, 2026
CVE-2026-116897
28Monitor
REDAXO before 5.21.4 Missing Authorization in Version and History Previews
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
redaxo · coreOct 27, 2026
CVE-2026-116898
28Monitor
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
redaxo · coreOct 27, 2026
CVE-2026-116899
28Monitor
REDAXO before 5.21.4 Broken Access Control in Slice Operations
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
redaxo · coreOct 27, 2026
CVE-2026-117341
30Monitor
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log.
HighCVSS 7.7No exploitEPSS 0%
- Info leak
octopus deploy · octopus serverOct 27, 2026
CVE-2026-117466
34Monitor
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
HighCVSS 8.6No exploitEPSS 0%
octopus deploy · octopus serverOct 27, 2026
CVE-2026-117532
37Monitor
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
redaxo · coreOct 27, 2026
CVE-2026-117536
34Monitor
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- CSRF
redaxo · coreOct 27, 2026
CVE-2026-117540
34Monitor
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
darylldoyle · svg-sanitizerOct 27, 2026
CVE-2026-102800
34Monitor
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- XSS
dj-extensions.com · dj-helpfularticles extension for joomlaOct 27, 2026
CVE-2026-106087
34Monitor
TRO600 contains an arbitrary file read vulnerability.
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
hitachi energy · tro600 series firmwareOct 27, 2026
CVE-2026-109995
28Monitor
Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wplakeorg · advanced views – display framework – gutenberg/elementor/shortcodeOct 27, 2026
CVE-2026-10756
30Monitor
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to
HighCVSS 7.7No exploitEPSS 0%
hitachi energy · tro600 series firmwareOct 27, 2026
CVE-2026-112362
36Monitor
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
@fastify/express · @fastify/expressOct 27, 2026
CVE-2026-115216
36Monitor
Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
eclipse foundation · eclipse iofogOct 27, 2026
CVE-2026-13162
30Monitor
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system command
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Command injection
hitachi energy · coretec 5Oct 27, 2026
CVE-2026-41020
30Monitor
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
eaton · easye4Oct 27, 2026
CVE-2026-41021
30Monitor
Eaton easyE4 uses an insufficiently strong password policy.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
eaton · easye4Oct 27, 2026
CVE-2026-4337
35Monitor
Unrestricted Upload of File in PuMuKIT application
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- File upload
pumukit · pumukitOct 27, 2026
CVE-2026-100164
30Monitor
User Enumeration in Rolantis Information Technologies' Agentis
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
rolantis information technologies tourism industry and trade co. ltd. · agentisOct 27, 2026
CVE-2026-116627
34Monitor
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
devolutions · powershell universalOct 27, 2026
CVE-2026-24269
28Monitor
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.
HighCVSS 7.1No exploitEPSS 0%
- SSRF
nvidia · tensorrt-llmOct 27, 2026
CVE-2026-47486
31Monitor
NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
nvidia · physxOct 27, 2026
CVE-2026-65119
33Monitor
NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusi
HighCVSS 8.4No exploitEPSS 0%
nvidia · tensorrt-llmOct 27, 2026
CVE-2026-65120
28Monitor
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery.
HighCVSS 7.1No exploitEPSS 0%
- SSRF
nvidia · tensorrt-llmOct 27, 2026
CVE-2026-65145
40Plan
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue.
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
nvidia · nemo agent toolkitOct 27, 2026
CVE-2026-65151
33Monitor
NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue.
HighCVSS 8.4No exploitEPSS 0%
- SQL injection
nvidia · nemo agent toolkitOct 27, 2026
CVE-2026-92546
30Monitor
Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
keepnet labs cybersecurity inc. · agentic ai / agentic allyOct 27, 2026
CVE-2026-117553
30Monitor
Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Open redirect
umbraco · umbraco-cmsOct 27, 2026
CVE-2026-117558
34Monitor
ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
ai-sdlc-framework · ai-sdlcOct 27, 2026
CVE-2026-117559
34Monitor
DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
hyperb1iss · droidmindOct 27, 2026
CVE-2026-117560
34Monitor
ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
atxp · gemini-cli-extensionOct 27, 2026
CVE-2026-117561
34Monitor
sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
HighCVSS 8.5Proof of conceptEPSS 0%
- RCE
- Command injection
codefriar · sf-mcpOct 27, 2026
CVE-2026-117564
37Monitor
nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
buqiyuan · nest-adminOct 27, 2026
CVE-2026-117567
34Monitor
esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
horw · esp-mcpOct 27, 2026
CVE-2026-117568
29Monitor
mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Command injection
bitscorp-mcp · mcp-ffmpegOct 27, 2026
CVE-2026-117569
34Monitor
Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
alishahid74 · kali-gptOct 27, 2026
CVE-2026-117573
34Monitor
hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
masc-ucsc · hagentOct 27, 2026
CVE-2026-117601
37Monitor
Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
spesmilo · electrumOct 27, 2026
CVE-2026-117602
34Monitor
Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Weak crypto
spesmilo · electrumOct 27, 2026
CVE-2026-117603
37Monitor
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Race condition
spesmilo · electrumOct 27, 2026
CVE-2026-117860
32Monitor
Same-origin policy bypass in the DOM: Navigation component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxOct 27, 2026
CVE-2026-117861
38Monitor
Sandbox escape in the DOM: Navigation component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
mozilla · firefoxOct 27, 2026
CVE-2026-117862
39Monitor
Privilege escalation due to incorrect boundary conditions in the Networking component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxOct 27, 2026