Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 77 of 88

  • CVE-2026-118004
    32Monitor

    Incorrect boundary conditions in the CSS Transitions and Animations component

    HighCVSS 8.1No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118005
    35Monitor

    Use-after-free in the WebRTC: Signaling component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118006
    35Monitor

    Privilege escalation due to use-after-free in the WebRTC: Signaling component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118007
    35Monitor

    Use-after-free in the JavaScript: GC component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118008
    35Monitor

    Privilege escalation in the DOM: Navigation component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118009
    35Monitor

    Integer overflow, use-after-free in the Graphics: Text component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118010
    35Monitor

    Use-after-free in the Disability Access APIs component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118011
    35Monitor

    Frame poisoning in the CSS Parsing and Computation component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118012
    35Monitor

    Use-after-free in the DOM: Animation component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118013
    35Monitor

    Use-after-free in the Layout: Images, Video, and HTML Frames component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118014
    35Monitor

    Use-after-free in the JavaScript Engine: JIT component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118015
    35Monitor

    Use-after-free in the DOM: Core & HTML component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118016
    35Monitor

    Use-after-free in the DOM: Core & HTML component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118017
    35Monitor

    Use-after-free in the SVG component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118018
    35Monitor

    Spoofing issue in the Downloads component in Firefox for Android

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118019
    35Monitor

    Race condition, use-after-free in the DOM: File component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118020
    35Monitor

    Use-after-free in the Layout component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118021
    35Monitor

    Sandbox escape due to use-after-free in the XPCOM component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118022
    35Monitor

    Sandbox escape due to use-after-free in the Disability Access APIs component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118023
    35Monitor

    Sandbox escape due to use-after-free in the Graphics: WebRender component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118024
    35Monitor

    Use-after-free in the Graphics: Text component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118025
    35Monitor

    Other issue in the SVG component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118026
    35Monitor

    Invalid pointer in the JavaScript: GC component

    HighCVSS 8.8No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-118027
    36Monitor

    Frame poisoning in the Layout component

    CriticalCVSS 9.1No exploitEPSS 0%

    mozilla · firefoxOct 27, 2026

  • CVE-2026-94346
    28Monitor

    PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70,

    HighCVSS 7.2No exploitEPSS 0%

    dell · powerprotect data domain virtual editionOct 27, 2026

  • CVE-2026-94347
    28Monitor

    PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70,

    HighCVSS 7.2No exploitEPSS 0%

    dell · powerprotect data domain virtual editionOct 27, 2026

  • CVE-2026-117604
    34Monitor

    Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

    HighCVSS 8.7No exploitEPSS 0%

    getgrav · gravOct 27, 2026

  • CVE-2026-78845
    39Monitor

    Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vuln

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 27, 2026

  • GHSA-g5ff-637f-6q2m
    32Monitor

    LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

    HighCVSS 8.1No exploit

    Oct 27, 2026

  • GHSA-3w55-933p-8pv5
    28Monitor

    Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage

    HighCVSS 7.1No exploit

    Oct 27, 2026

  • CVE-2026-103593
    28Monitor

    Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution

    HighCVSS 7.1No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-103594
    38Monitor

    Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution

    CriticalCVSS 9.5No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-104189
    30Monitor

    3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share

    HighCVSS 7.5No exploitEPSS 0%

    maz1987in · 3dviewer-nextcloudOct 27, 2026

  • CVE-2026-107672
    35Monitor

    Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility

    HighCVSS 8.8No exploitEPSS 0%

    autodesk · fusion post processor utilityOct 27, 2026

  • CVE-2026-111107
    34Monitor

    Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service

    HighCVSS 8.7No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-111582
    29Monitor

    Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows

    HighCVSS 7.3No exploitEPSS 0%

    teamviewer · remote management - monitoringOct 27, 2026

  • CVE-2026-111583
    29Monitor

    Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows

    HighCVSS 7.3No exploitEPSS 0%

    teamviewer · full clientOct 27, 2026

  • CVE-2026-111584
    29Monitor

    Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

    HighCVSS 7.3No exploitEPSS 0%

    teamviewer · teamviewer remote - patch managementOct 27, 2026

  • CVE-2026-111585
    35Monitor

    Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

    HighCVSS 8.8Proof of conceptEPSS 0%

    teamviewer · full clientOct 27, 2026

  • CVE-2026-112709
    36Monitor

    Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

    CriticalCVSS 9.2No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-112710
    36Monitor

    Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

    CriticalCVSS 9.2No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-116863
    38Monitor

    WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

    CriticalCVSS 9.6No exploitEPSS 0%

    tribulant software · newslettersOct 27, 2026

  • CVE-2026-90442
    34Monitor

    Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service

    HighCVSS 8.6No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-90464
    28Monitor

    Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root

    HighCVSS 7.2No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-90465
    37Monitor

    Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation

    CriticalCVSS 9.4No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-92372
    35Monitor

    Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

    HighCVSS 8.8No exploitEPSS 0%

    teamviewer · full clientOct 27, 2026

  • CVE-2026-92374
    31Monitor

    Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

    HighCVSS 7.8No exploitEPSS 0%

    teamviewer · full clientOct 27, 2026

  • CVE-2026-92375
    31Monitor

    Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring

    HighCVSS 7.8No exploitEPSS 0%

    teamviewer · full clientOct 27, 2026

  • CVE-2026-92376
    31Monitor

    Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

    HighCVSS 7.8No exploitEPSS 0%

    teamviewer · remote management - monitoringOct 27, 2026

  • CVE-2026-92377
    31Monitor

    Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows

    HighCVSS 7.8No exploitEPSS 0%

    teamviewer · full clientOct 27, 2026

  • CVE-2026-93434
    34Monitor

    Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets

    HighCVSS 8.7No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-93857
    36Monitor

    Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution

    CriticalCVSS 9.2No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-93862
    28Monitor

    Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service

    HighCVSS 7.2No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-93864
    28Monitor

    Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root

    HighCVSS 7.1No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-93865
    36Monitor

    Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection

    CriticalCVSS 9.2No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • CVE-2026-93866
    36Monitor

    Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write

    CriticalCVSS 9.2No exploitEPSS 0%

    watchguard · fireware osOct 27, 2026

  • GHSA-wf6j-7hvr-gr93
    31Monitor

    Hydra legacy target blacklist permits unsafe PyYAML loading

    HighCVSS 7.8No exploit

    Oct 27, 2026

  • CVE-2026-102636
    28Monitor

    Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

    HighCVSS 7.1No exploitEPSS 0%

    autodesk · fusionOct 27, 2026

  • CVE-2026-102637
    28Monitor

    Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

    HighCVSS 7.1No exploitEPSS 0%

    autodesk · fusionOct 27, 2026

  • CVE-2026-102638
    28Monitor

    Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

    HighCVSS 7.1No exploitEPSS 0%

    autodesk · fusionOct 27, 2026

  • CVE-2026-104349
    29Monitor

    Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)

    HighCVSS 7.3No exploitEPSS 0%

    adobe · creative cloud desktop applicationOct 27, 2026

  • CVE-2026-104350
    37Monitor

    Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)

    CriticalCVSS 9.3No exploitEPSS 0%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-104351
    39Monitor

    Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

    CriticalCVSS 9.9No exploitEPSS 0%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-104353
    39Monitor

    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

    CriticalCVSS 9.9No exploitEPSS 1%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-104354
    36Monitor

    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.1No exploitEPSS 0%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-105477
    29Monitor

    A vulnerability in Veeam Agent for Linux allows for local privilege escalation.

    HighCVSS 7.3No exploitEPSS 0%

    veeam · agent for linuxOct 27, 2026

  • CVE-2026-105489
    39Monitor

    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.9No exploitEPSS 0%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-105779
    36Monitor

    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.1No exploitEPSS 0%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-105780
    39Monitor

    Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.9No exploitEPSS 0%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-105781
    40Plan

    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 10.0No exploitEPSS 0%

    adobe · adobe campaign classicOct 27, 2026

  • CVE-2026-106076
    36Monitor

    A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backu

    CriticalCVSS 9.0No exploitEPSS 0%

    veeam · backup for microsoft 365Oct 27, 2026

  • CVE-2026-106077
    33Monitor

    A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with

    HighCVSS 8.3No exploitEPSS 0%

    veeam · backup for microsoft 365Oct 27, 2026

  • CVE-2026-107671
    34Monitor

    A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally bef

    HighCVSS 8.5No exploitEPSS 0%

    veeam · oneOct 27, 2026

  • CVE-2026-108014
    36Monitor

    eMudhra Compromised Certificate vulnerability impacts HCL Domino Server

    CriticalCVSS 9.1No exploitEPSS 0%

    hclsoftware · domino serverOct 27, 2026

  • CVE-2026-108015
    36Monitor

    eMudhra Compromised Certificate vulnerability impacts HCL Notes Client

    CriticalCVSS 9.1No exploitEPSS 0%

    hclsoftware · notes clientOct 27, 2026

  • CVE-2026-108142
    36Monitor

    A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

    CriticalCVSS 9.1No exploitEPSS 0%

    veeam · backup and replicationOct 27, 2026

  • CVE-2026-109089
    30Monitor

    libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow

    HighCVSS 7.5No exploitEPSS 0%

    x.org · libxiOct 27, 2026

  • CVE-2026-109090
    30Monitor

    libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

    HighCVSS 7.5No exploitEPSS 0%

    x.org · libxiOct 27, 2026

  • CVE-2026-113775
    31Monitor

    Dynamic Library Loading Process Control in Autodesk Fusion Desktop

    HighCVSS 7.8No exploitEPSS 0%

    autodesk · fusionOct 27, 2026

  • CVE-2026-114595
    37Monitor

    Integer overflow or wraparound in EPICS Base

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    the epics community · epics baseOct 27, 2026

  • CVE-2026-114596
    35Monitor

    Integer overflow or wraparound in EPICS Base

    HighCVSS 8.8No exploitEPSS 0%

    the epics community · epics baseOct 27, 2026

  • CVE-2026-114597
    34Monitor

    Improper handling of length parameter inconsistency in EPICS Base

    HighCVSS 8.7No exploitEPSS 0%

    the epics community · epics baseOct 27, 2026

  • CVE-2026-114598
    34Monitor

    Access of resource using incompatible type ('type confusion') in EPICS Base

    HighCVSS 8.7No exploitEPSS 0%

    the epics community · epics baseOct 27, 2026

  • CVE-2026-116672
    35Monitor

    Authlib RFC 7592 examples omit registration-access-token client binding

    HighCVSS 8.8No exploitEPSS 0%

    authlib · authlibOct 27, 2026

  • CVE-2026-116675
    34Monitor

    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

    HighCVSS 8.5No exploitEPSS 0%

    tinymce · tinymceOct 27, 2026

  • CVE-2026-48360
    38Monitor

    Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)

    CriticalCVSS 9.6No exploitEPSS 0%

    adobe · adobe connect desktop appOct 27, 2026

  • CVE-2026-48379
    31Monitor

    Substance3D - Painter | Stack-based Buffer Overflow (CWE-121)

    HighCVSS 7.8No exploitEPSS 0%

    adobe · adobe substance 3d painterOct 27, 2026

  • CVE-2026-57197
    30Monitor

    Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)

    HighCVSS 7.7No exploitEPSS 0%

    asterisk · asteriskOct 27, 2026

  • CVE-2026-57201
    30Monitor

    Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer

    HighCVSS 7.5No exploitEPSS 0%

    asterisk · asteriskOct 27, 2026

  • CVE-2026-77167
    30Monitor

    Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table.

    HighCVSS 7.5No exploitEPSS 0%

    nextcloud · serverOct 27, 2026

  • CVE-2026-102814
    34Monitor

    Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305

    HighCVSS 8.7No exploitEPSS 0%

    tp-link systems inc. · re305 v3Oct 27, 2026

  • CVE-2026-108303
    35Monitor

    Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

    HighCVSS 8.8No exploitEPSS 0%

    tanium · certificate managerOct 27, 2026

  • CVE-2026-108304
    31Monitor

    Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

    HighCVSS 7.8No exploitEPSS 0%

    tanium · endpoint configuration toolset solutionOct 27, 2026

  • CVE-2026-108305
    31Monitor

    Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

    HighCVSS 7.8No exploitEPSS 0%

    tanium · endpoint configuration toolset solutionOct 27, 2026

  • CVE-2026-108306
    31Monitor

    Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

    HighCVSS 7.8No exploitEPSS 0%

    tanium · endpoint configuration toolset solutionOct 27, 2026

  • CVE-2026-108307
    31Monitor

    Tanium addressed a heap-based buffer overflow vulnerability in Index.

    HighCVSS 7.8No exploitEPSS 0%

    tanium · endpoint configuration toolset solutionOct 27, 2026

  • CVE-2026-108329
    35Monitor

    Tanium addressed an unauthorized code execution vulnerability in Threat Response.

    HighCVSS 8.8No exploitEPSS 0%

    tanium · threat responseOct 27, 2026

  • CVE-2026-116647
    28Monitor

    Tanium addressed an improper output sanitization vulnerability in Comply.

    HighCVSS 7.1No exploitEPSS 0%

    tanium · complyOct 27, 2026

  • CVE-2026-116649
    28Monitor

    Tanium addressed an improper output sanitization vulnerability in Enforce.

    HighCVSS 7.1No exploitEPSS 0%

    tanium · enforceOct 27, 2026

  • CVE-2026-116656
    30Monitor

    Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

    HighCVSS 7.5No exploitEPSS 0%

    tanium · enforceOct 27, 2026