By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 78 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-116656No exploit	Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.tanium · enforce · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 27, 2026
30Monitor	CVE-2026-116662No exploit	Tanium addressed a compression bomb vulnerability in Enforce.tanium · enforce · CWE-409 Pre-auth Denial of service	High7.5	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-116676No exploit	Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planrunatlantis · atlantis · CWE-78 RCE Command injection	High8.8	—	0.4%	Oct 27, 2026
34Monitor	CVE-2026-116682No exploit	FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directorygtsteffaniak · filebrowser · CWE-22 Pre-auth Path traversal	High8.6	—	0.5%	Oct 27, 2026
39Monitor	CVE-2026-118131No exploit	GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\Prognupg · gnupg · CWE-379 Pre-auth	Critical9.8	—	0.4%	Oct 27, 2026
28Monitor	CVE-2026-57188No exploit	Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handlingasterisk · asterisk · CWE-787 Memory safety	High7.1	—	0.5%	Oct 27, 2026
32Monitor	CVE-2026-57202No exploit	Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writesasterisk · asterisk · CWE-267	High8.1	—	0.4%	Oct 27, 2026
30Monitor	CVE-2026-87086No exploit	Tanium addressed a denial of service vulnerability in Provision.tanium · provision · CWE-690 Pre-auth Denial of service	High7.5	—	0.3%	Oct 27, 2026
31Monitor	CVE-2026-88812No exploit	X.Org Server XKB SetGeometry TextDoodad Double Freex.org · xorg-x11-server · CWE-415 Memory safety	High7.8	—	0.1%	Oct 27, 2026
30Monitor	GHSA-f897-62hf-6gxqNo exploit	MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch lengthCWE-770 Pre-auth Denial of service	High7.5	—	—	Oct 27, 2026
29Monitor	CVE-2026-115413No exploit	AWS API MCP Server OAuth Token Audience Validation Bypassaws · aws-api-mcp-server · CWE-346	High7.3	—	0.0%	Oct 27, 2026
28Monitor	CVE-2026-116683No exploit	CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesctfer-io · terraform-provider-ctfd · CWE-522 Info leak	High7.1	—	0.3%	Oct 27, 2026
36Monitor	CVE-2026-118170No exploit	The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whestrapi · strapi open source and enterprise headless cms · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.2%	Oct 27, 2026
30Monitor	CVE-2026-118175No exploit	Content of other messages could be included when replying to a crafted messagemozilla · thunderbird · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Oct 27, 2026
32Monitor	CVE-2026-118176No exploit	Bypass of remote UNC path restriction in mailbox: URLsmozilla · thunderbird · CWE-200 Pre-auth Info leak	High8.1	—	0.4%	Oct 27, 2026
36Monitor	CVE-2026-118177No exploit	Calendar discovery accepted local file and remote network share locationsmozilla · thunderbird · CWE-601 Pre-auth Open redirect	Critical9.1	—	0.4%	Oct 27, 2026
35Monitor	CVE-2026-118179No exploit	Request forgery via news: linksmozilla · thunderbird · CWE-20 Pre-auth	High8.8	—	0.3%	Oct 27, 2026
30Monitor	CVE-2026-118180No exploit	Matrix homeserver could redirect the chat session to a local file or network sharemozilla · thunderbird · CWE-601 Pre-auth Open redirect	High7.5	—	0.3%	Oct 27, 2026
34Monitor	CVE-2026-112350No exploit	Sunhillo SureLine Path Traversal via radarUpdater.cgisunhillo · sureline · CWE-22 Pre-auth Auth bypass Path traversal	High8.7	—	0.9%	Oct 27, 2026
35Monitor	CVE-2026-112351No exploit	Sunhillo SureLine OS Command Injection via networkDiag.cgisunhillo · sureline · CWE-78 RCE Command injection	High8.7	—	2.6%	Oct 27, 2026
36Monitor	CVE-2026-112352No exploit	Sunhillo SureLine Authentication Bypass via Session Cookiesunhillo · sureline · CWE-565 pre-auth RCE Auth bypass	Critical9.1	—	1.4%	Oct 27, 2026
34Monitor	CVE-2026-112355No exploit	MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST APImembershipworks · membershipworks · CWE-862 Pre-auth Broken access control (IDOR)	High8.7	—	0.2%	Oct 27, 2026
32Monitor	CVE-2026-116688No exploit	CKEditor: Cross-site scripting (XSS) in the engine packageckeditor · ckeditor5 · CWE-79 XSS	High8.1	—	0.4%	Oct 27, 2026
31Monitor	CVE-2026-116690Proof of concept	MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version sourcemlflow · mlflow · CWE-22 Pre-auth Path traversal	High7.5	—	1.8%	Oct 27, 2026
39Monitor	CVE-2026-116692Proof of concept	MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesmlflow · mlflow · CWE-94 pre-auth RCE Deserialization	Critical9.8	—	0.7%	Oct 27, 2026
34Monitor	CVE-2026-116693No exploit	dd-trace: ReDOS in URL query string obfuscationdatadog · dd-trace-js · CWE-1333 Pre-auth Denial of service	High8.7	—	0.4%	Oct 27, 2026
30Monitor	CVE-2026-57195No exploit	Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authenticationasterisk · asterisk · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 27, 2026
30Monitor	CVE-2026-57200No exploit	Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCEasterisk · asterisk · CWE-22 RCE Path traversal	High7.5	—	0.8%	Oct 27, 2026
35Monitor	CVE-2026-83831No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-415 pre-auth RCE Memory safety	High8.8	—	0.7%	Oct 27, 2026
35Monitor	CVE-2026-85898No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-843 pre-auth RCE	High8.8	—	0.7%	Oct 27, 2026
30Monitor	CVE-2026-57186No exploit	Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parserasterisk · asterisk · CWE-839 Pre-auth Denial of service	High7.5	—	0.6%	Oct 27, 2026
28Monitor	CVE-2026-57190No exploit	Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Fieldasterisk · asterisk · CWE-89 Pre-auth SQL injection	High7.0	—	0.6%	Oct 27, 2026
32Monitor	CVE-2026-57191No exploit	Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsingasterisk · asterisk · CWE-120 Pre-auth Memory safety	High8.2	—	0.5%	Oct 27, 2026
32Monitor	CVE-2026-62765No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-843 pre-auth RCE	High8.1	—	0.4%	Oct 27, 2026
30Monitor	CVE-2026-78661No exploit	Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netgolang.org/x/net · golang.org/x/net/html · CWE-407 Pre-auth	High7.5	—	0.4%	Oct 27, 2026
35Monitor	CVE-2026-118304No exploit	Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-118305No exploit	Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-843 pre-auth RCE	Critical9.6	—	0.4%	Oct 27, 2026
38Monitor	CVE-2026-118306Proof of concept	Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandboxgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118307No exploit	Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
38Monitor	CVE-2026-118308No exploit	Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Oct 27, 2026
38Monitor	CVE-2026-118309No exploit	Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engingoogle · chrome · CWE-706 Pre-auth	Critical9.6	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-118310No exploit	Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary codgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118311No exploit	Use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-118312No exploit	Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data vigoogle · chrome · CWE-203 Pre-auth	Critical9.6	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118313No exploit	Out of bounds write in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox google · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118314No exploit	Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social enginegoogle · chrome · CWE-706 Pre-auth	High8.8	—	0.1%	Oct 27, 2026
35Monitor	CVE-2026-118315No exploit	Type confusion in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sangoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-118316No exploit	Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118317No exploit	Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118320No exploit	Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandgoogle · chrome · CWE-362 pre-auth RCE Race condition	High8.8	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-118321No exploit	Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118327No exploit	Incorrect authorization in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118328No exploit	Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside the sandbox via a craftgoogle · chrome · CWE-125 Pre-auth Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118329No exploit	Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118330No exploit	Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to egoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118331No exploit	Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
38Monitor	CVE-2026-118332No exploit	Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.2%	Oct 27, 2026
37Monitor	CVE-2026-118333No exploit	Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.3	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118334No exploit	Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbogoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118335No exploit	Out of bounds write in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer google · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118336No exploit	Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside tgoogle · chrome · CWE-362 pre-auth RCE Race condition	High8.8	—	0.2%	Oct 27, 2026
37Monitor	CVE-2026-118337No exploit	Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.3	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118338No exploit	Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafgoogle · chrome · CWE-203 Pre-auth	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118339No exploit	Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
38Monitor	CVE-2026-118340No exploit	Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML pagoogle · chrome · CWE-190 Pre-auth Memory safety	Critical9.6	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118341No exploit	Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-118342No exploit	Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118343No exploit	Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118344No exploit	Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118345No exploit	Buffer overflow in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118346No exploit	Out of bounds read in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-125 Pre-auth Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118347No exploit	Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outsidegoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118348No exploit	Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside thegoogle · chrome · CWE-190 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118349No exploit	Use after free in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to potentially exgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118350No exploit	Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118351No exploit	Use after free in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118352No exploit	Use after free in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118353No exploit	Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted Hgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118354No exploit	Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted Hgoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.2%	Oct 27, 2026
38Monitor	CVE-2026-118355No exploit	Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118356No exploit	Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sangoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118357No exploit	Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandboxgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-118358No exploit	Use after free in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 27, 2026
35Monitor	CVE-2026-118359No exploit	Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 27, 2026
32Monitor	CVE-2026-58205No exploit	GRR has a Reflected XSS issuejeromedevome · grr · CWE-79 Pre-auth XSS	High8.1	—	0.2%	Oct 27, 2026
35Monitor	CVE-2026-58255No exploit	Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401jhuckaby · cronicle · CWE-269	High8.8	—	0.4%	Oct 27, 2026
36Monitor	CVE-2026-58256No exploit	GRR vulnerable to Remote Code Execution Via PHP Code Injectionjeromedevome · grr · CWE-94 RCE	Critical9.1	—	0.5%	Oct 27, 2026
28Monitor	CVE-2026-58257No exploit	GRR vulnerable to Arbitrary File Read and Deletionjeromedevome · grr · CWE-22 Path traversal	High7.2	—	0.4%	Oct 27, 2026
30Monitor	CVE-2026-59158No exploit	Nuxt Ollama: public runtime configuration discloses the configured cloud API keythoda-dev · nuxt-ollama · CWE-522 Pre-auth Info leak	High7.5	—	0.5%	Oct 27, 2026
30Monitor	CVE-2026-104016No exploit	jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorfasterxml · jackson-dataformat-protobuf · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.6%	Oct 28, 2026
30Monitor	CVE-2026-104895No exploit	jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of servicefasterxml · jackson-dataformat-smile · CWE-789 Pre-auth Denial of service	High7.5	—	0.3%	Oct 28, 2026
30Monitor	CVE-2026-110747No exploit	jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payloadfasterxml · jackson-dataformat-protobuf · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 28, 2026
39Monitor	CVE-2026-110879No exploit	jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVfasterxml · jackson-databind · CWE-502 Pre-auth Deserialization	Critical9.8	—	1.1%	Oct 28, 2026
39Monitor	CVE-2026-106013No exploit	Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameterartbees · jupiter x core · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 28, 2026
35Monitor	CVE-2013-20007No exploit	Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgilinksys · wag200g · CWE-78 RCE Command injection	High8.6	—	2.0%	Oct 28, 2026
28Monitor	CVE-2013-20008No exploit	Linksys WAG200G through 1.01.06 Admin Password Change Without Current Passwordlinksys · wag200g · CWE-620	High7.0	—	0.2%	Oct 28, 2026
32Monitor	CVE-2014-125136No exploit	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backupc97net · qengine cms · CWE-530 Pre-auth	High8.2	—	0.4%	Oct 28, 2026
28Monitor	CVE-2014-125137No exploit	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.phpc97net · qengine cms · CWE-98 Path traversal	High7.1	—	0.7%	Oct 28, 2026
34Monitor	CVE-2014-125138No exploit	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fieldsc97net · qengine cms · CWE-434 File upload	High8.7	—	0.4%	Oct 28, 2026
34Monitor	CVE-2015-20129No exploit	CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/crushftp · crushftp · CWE-352 Pre-auth CSRF	High8.6	—	0.1%	Oct 28, 2026

CVE-2026-116656
30Monitor
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
tanium · enforceOct 27, 2026
CVE-2026-116662
30Monitor
Tanium addressed a compression bomb vulnerability in Enforce.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
tanium · enforceOct 27, 2026
CVE-2026-116676
35Monitor
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
runatlantis · atlantisOct 27, 2026
CVE-2026-116682
34Monitor
FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
gtsteffaniak · filebrowserOct 27, 2026
CVE-2026-118131
39Monitor
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\Pro
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
gnupg · gnupgOct 27, 2026
CVE-2026-57188
28Monitor
Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
asterisk · asteriskOct 27, 2026
CVE-2026-57202
32Monitor
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
HighCVSS 8.1No exploitEPSS 0%
asterisk · asteriskOct 27, 2026
CVE-2026-87086
30Monitor
Tanium addressed a denial of service vulnerability in Provision.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
tanium · provisionOct 27, 2026
CVE-2026-88812
31Monitor
X.Org Server XKB SetGeometry TextDoodad Double Free
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
x.org · xorg-x11-serverOct 27, 2026
GHSA-f897-62hf-6gxq
30Monitor
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 27, 2026
CVE-2026-115413
29Monitor
AWS API MCP Server OAuth Token Audience Validation Bypass
HighCVSS 7.3No exploitEPSS 0%
aws · aws-api-mcp-serverOct 27, 2026
CVE-2026-116683
28Monitor
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
HighCVSS 7.1No exploitEPSS 0%
- Info leak
ctfer-io · terraform-provider-ctfdOct 27, 2026
CVE-2026-118170
36Monitor
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whe
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
strapi · strapi open source and enterprise headless cmsOct 27, 2026
CVE-2026-118175
30Monitor
Content of other messages could be included when replying to a crafted message
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
mozilla · thunderbirdOct 27, 2026
CVE-2026-118176
32Monitor
Bypass of remote UNC path restriction in mailbox: URLs
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Info leak
mozilla · thunderbirdOct 27, 2026
CVE-2026-118177
36Monitor
Calendar discovery accepted local file and remote network share locations
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Open redirect
mozilla · thunderbirdOct 27, 2026
CVE-2026-118179
35Monitor
Request forgery via news: links
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · thunderbirdOct 27, 2026
CVE-2026-118180
30Monitor
Matrix homeserver could redirect the chat session to a local file or network share
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Open redirect
mozilla · thunderbirdOct 27, 2026
CVE-2026-112350
34Monitor
Sunhillo SureLine Path Traversal via radarUpdater.cgi
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Path traversal
sunhillo · surelineOct 27, 2026
CVE-2026-112351
35Monitor
Sunhillo SureLine OS Command Injection via networkDiag.cgi
HighCVSS 8.7No exploitEPSS 2%
- RCE
- Command injection
sunhillo · surelineOct 27, 2026
CVE-2026-112352
36Monitor
Sunhillo SureLine Authentication Bypass via Session Cookie
CriticalCVSS 9.1No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
sunhillo · surelineOct 27, 2026
CVE-2026-112355
34Monitor
MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
membershipworks · membershipworksOct 27, 2026
CVE-2026-116688
32Monitor
CKEditor: Cross-site scripting (XSS) in the engine package
HighCVSS 8.1No exploitEPSS 0%
- XSS
ckeditor · ckeditor5Oct 27, 2026
CVE-2026-116690
31Monitor
MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Path traversal
mlflow · mlflowOct 27, 2026
CVE-2026-116692
39Monitor
MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Deserialization
mlflow · mlflowOct 27, 2026
CVE-2026-116693
34Monitor
dd-trace: ReDOS in URL query string obfuscation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
datadog · dd-trace-jsOct 27, 2026
CVE-2026-57195
30Monitor
Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
asterisk · asteriskOct 27, 2026
CVE-2026-57200
30Monitor
Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Path traversal
asterisk · asteriskOct 27, 2026
CVE-2026-83831
35Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · edge chromiumOct 27, 2026
CVE-2026-85898
35Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
microsoft · edge chromiumOct 27, 2026
CVE-2026-57186
30Monitor
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
asterisk · asteriskOct 27, 2026
CVE-2026-57190
28Monitor
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- SQL injection
asterisk · asteriskOct 27, 2026
CVE-2026-57191
32Monitor
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
asterisk · asteriskOct 27, 2026
CVE-2026-62765
32Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
microsoft · edge chromiumOct 27, 2026
CVE-2026-78661
30Monitor
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
golang.org/x/net · golang.org/x/net/htmlOct 27, 2026
CVE-2026-118304
35Monitor
Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118305
38Monitor
Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vi
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 27, 2026
CVE-2026-118306
38Monitor
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox
CriticalCVSS 9.6Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118307
35Monitor
Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118308
38Monitor
Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118309
38Monitor
Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engin
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 27, 2026
CVE-2026-118310
38Monitor
Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary cod
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118311
35Monitor
Use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the s
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118312
38Monitor
Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data vi
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
google · chromeOct 27, 2026
CVE-2026-118313
35Monitor
Out of bounds write in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118314
35Monitor
Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engine
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 27, 2026
CVE-2026-118315
35Monitor
Type confusion in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the san
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 27, 2026
CVE-2026-118316
38Monitor
Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118317
35Monitor
Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118320
35Monitor
Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sand
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 27, 2026
CVE-2026-118321
38Monitor
Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer proc
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118327
35Monitor
Incorrect authorization in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain s
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 27, 2026
CVE-2026-118328
35Monitor
Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside the sandbox via a craft
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118329
35Monitor
Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandb
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118330
35Monitor
Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to e
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118331
35Monitor
Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118332
38Monitor
Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118333
37Monitor
Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118334
35Monitor
Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbo
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118335
35Monitor
Out of bounds write in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118336
35Monitor
Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside t
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 27, 2026
CVE-2026-118337
37Monitor
Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118338
35Monitor
Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 27, 2026
CVE-2026-118339
35Monitor
Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox v
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118340
38Monitor
Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML pa
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118341
35Monitor
Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sand
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118342
38Monitor
Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118343
35Monitor
Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arb
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118344
35Monitor
Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118345
35Monitor
Buffer overflow in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118346
35Monitor
Out of bounds read in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118347
35Monitor
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118348
35Monitor
Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118349
35Monitor
Use after free in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to potentially ex
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118350
35Monitor
Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 27, 2026
CVE-2026-118351
35Monitor
Use after free in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118352
35Monitor
Use after free in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118353
35Monitor
Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted H
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 27, 2026
CVE-2026-118354
35Monitor
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted H
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118355
38Monitor
Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118356
35Monitor
Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the san
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118357
35Monitor
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118358
35Monitor
Use after free in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-118359
35Monitor
Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 27, 2026
CVE-2026-58205
32Monitor
GRR has a Reflected XSS issue
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- XSS
jeromedevome · grrOct 27, 2026
CVE-2026-58255
35Monitor
Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
HighCVSS 8.8No exploitEPSS 0%
jhuckaby · cronicleOct 27, 2026
CVE-2026-58256
36Monitor
GRR vulnerable to Remote Code Execution Via PHP Code Injection
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
jeromedevome · grrOct 27, 2026
CVE-2026-58257
28Monitor
GRR vulnerable to Arbitrary File Read and Deletion
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
jeromedevome · grrOct 27, 2026
CVE-2026-59158
30Monitor
Nuxt Ollama: public runtime configuration discloses the configured cloud API key
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
thoda-dev · nuxt-ollamaOct 27, 2026
CVE-2026-104016
30Monitor
jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
fasterxml · jackson-dataformat-protobufOct 28, 2026
CVE-2026-104895
30Monitor
jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
fasterxml · jackson-dataformat-smileOct 28, 2026
CVE-2026-110747
30Monitor
jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
fasterxml · jackson-dataformat-protobufOct 28, 2026
CVE-2026-110879
39Monitor
jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CV
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Deserialization
fasterxml · jackson-databindOct 28, 2026
CVE-2026-106013
39Monitor
Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
artbees · jupiter x coreOct 28, 2026
CVE-2013-20007
35Monitor
Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
linksys · wag200gOct 28, 2026
CVE-2013-20008
28Monitor
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
HighCVSS 7.0No exploitEPSS 0%
linksys · wag200gOct 28, 2026
CVE-2014-125136
32Monitor
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
c97net · qengine cmsOct 28, 2026
CVE-2014-125137
28Monitor
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
c97net · qengine cmsOct 28, 2026
CVE-2014-125138
34Monitor
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
HighCVSS 8.7No exploitEPSS 0%
- File upload
c97net · qengine cmsOct 28, 2026
CVE-2015-20129
34Monitor
CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- CSRF
crushftp · crushftpOct 28, 2026