By publication date

Exploited and new serious CVEs: October 2026

8,744 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 79 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
32Monitor	CVE-2026-118374No exploit	LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Responseopenbsd · libressl · CWE-770 Pre-auth Denial of service	High8.2	—	0.2%	Oct 28, 2026
36Monitor	CVE-2026-118375No exploit	llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()ggml-org · llama.cpp · CWE-787 Pre-auth Memory safety	Critical9.2	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-118377No exploit	mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacksmewebstudio · pos · CWE-345 Pre-auth	High8.7	—	0.1%	Oct 28, 2026
34Monitor	CVE-2026-118378No exploit	Tabularis before 0.28.0 SQL Injection via MCP describe_table table_nametabularisdb · tabularis · CWE-89 SQL injection	High8.5	—	0.1%	Oct 28, 2026
39Monitor	CVE-2026-84999No exploit	Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handlerpie register · pie register premium · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.4%	Oct 28, 2026
28Monitor	CVE-2026-97019No exploit	AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attributemohammed_kaludi · amp for wp – accelerated mobile pages · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 28, 2026
30Monitor	CVE-2026-111255No exploit	affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parametercservit · affiliate-toolkit – multi-network affiliate & amazon product display · CWE-434 RCE File upload	High7.5	—	0.5%	Oct 28, 2026
30Monitor	CVE-2026-116613No exploit	Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attributebplugins · animated text block – add typing and looping text effects · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 28, 2026
35Monitor	CVE-2026-1928No exploit	Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Executionrankmath · rank math seo – ai seo tools to dominate seo rankings · CWE-502 RCE Deserialization	High8.8	—	0.5%	Oct 28, 2026
37Monitor	CVE-2026-104383No exploit	Code injection in EagleCloud Aquila on-premises versioneaglecloud · aquila · CWE-94 RCE	Critical9.4	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-104384No exploit	Insufficiently protected credentials in EagleCloud Aquila on-premises versioneaglecloud · aquila · CWE-522 Pre-auth Info leak	High8.7	—	0.4%	Oct 28, 2026
39Monitor	CVE-2026-103688Proof of concept	Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Uploadunknown · checkout files upload for woocommerce · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.6%	Oct 28, 2026
30Monitor	CVE-2026-105972No exploit	WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attributeunknown · menu cart for woocommerce · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Oct 28, 2026
28Monitor	CVE-2026-111021No exploit	Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameterunknown · افزونه پیامک ووکامرس \| persian woocommerce sms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-111577No exploit	GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settingsunknown · gosmtp · CWE-269	High7.2	—	0.3%	Oct 28, 2026
27Monitor	CVE-2026-111967Proof of concept	MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attributeunknown · mp3 audio player · CWE-79 XSS	Medium6.8	—	0.3%	Oct 28, 2026
30Monitor	CVE-2026-15323No exploit	Product Designer for WooCommerce WordPress \| Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Uploadking-theme · product designer for woocommerce wordpress \| lumise · CWE-22 Pre-auth Path traversal	High7.5	—	0.8%	Oct 28, 2026
39Monitor	CVE-2026-109218No exploit	Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypasskleor · contact manager · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.6%	Oct 28, 2026
28Monitor	CVE-2026-109381No exploit	Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parametermagepeopleteam · event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendar · CWE-269	High7.2	—	0.4%	Oct 28, 2026
35Monitor	CVE-2026-109384Proof of concept	The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipmelograno · the innovative form builder – ivyforms · CWE-434 RCE File upload	High8.8	—	0.7%	Oct 28, 2026
28Monitor	CVE-2026-110662No exploit	MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_ratingmxchat · mxchat – ai chatbot & content generation for wordpress · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-111111No exploit	Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escapebdthemes · prime slider – hero slider, carousel, woocommerce & post slider elementor addons · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 28, 2026
35Monitor	CVE-2026-111120No exploit	VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Taske4jvikwp · vikrentcar car rental management system · CWE-352 pre-auth RCE CSRF	High8.8	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-63286Proof of concept	Database backups are vulnerable to offline attacks.axis communications ab · axis camera station pro · CWE-326 Weak crypto	High7.1	—	0.0%	Oct 28, 2026
35Monitor	CVE-2026-92797No exploit	Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parametermemberpress · memberpress · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 28, 2026
29Monitor	CVE-2026-86395No exploit	Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.dell · powerprotect data domain virtual edition · CWE-78 RCE Command injection	High7.2	—	2.1%	Oct 28, 2026
36Monitor	CVE-2026-86396No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-78 RCE Command injection	High8.8	—	2.1%	Oct 28, 2026
39Monitor	CVE-2026-86397No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-862 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.8	—	0.3%	Oct 28, 2026
35Monitor	CVE-2026-86398No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-22 Path traversal	High8.8	—	0.3%	Oct 28, 2026
29Monitor	CVE-2026-86399No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-78 RCE Command injection	High7.2	—	2.1%	Oct 28, 2026
39Monitor	CVE-2026-86400No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-287 pre-auth RCE Auth bypass	Critical9.8	—	0.8%	Oct 28, 2026
36Monitor	CVE-2026-90717No exploit	Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1dell · powerprotect data domain management center · CWE-290 Auth bypass	Critical9.1	—	0.2%	Oct 28, 2026
36Monitor	CVE-2026-14571No exploit	SQL injection (SQLi) in the user authentication module of Futurum Softwarefuturum software · futurum software user authentication module · CWE-89 pre-auth RCE SQL injection	Critical9.1	—	0.2%	Oct 28, 2026
29Monitor	CVE-2026-86379No exploit	Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1dell · powerprotect data domain management center · CWE-78 RCE Command injection	High7.2	—	2.8%	Oct 28, 2026
28Monitor	CVE-2026-86380No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-190 Memory safety	High7.2	—	0.4%	Oct 28, 2026
39Monitor	CVE-2026-86384No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-321 Pre-auth Hard-coded credentials	Critical9.8	—	0.4%	Oct 28, 2026
35Monitor	CVE-2026-86385No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability.dell · powerprotect data domain · CWE-273	High8.8	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-86389No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-190 Memory safety	High7.2	—	0.5%	Oct 28, 2026
28Monitor	CVE-2026-86393No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-269	High7.2	—	0.3%	Oct 28, 2026
29Monitor	CVE-2026-86394No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-78 RCE Command injection	High7.2	—	2.1%	Oct 28, 2026
28Monitor	CVE-2025-30414No exploit	Local privilege escalation due to improper authentication.acronis · acronis cyber protect cloud agent · CWE-1390 Auth bypass Local privilege escalation	High7.1	—	0.2%	Oct 28, 2026
33Monitor	CVE-2026-103779No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-287 Auth bypass	High8.3	—	0.4%	Oct 28, 2026
39Monitor	CVE-2026-103780No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	0.8%	Oct 28, 2026
38Monitor	CVE-2026-103792No exploit	Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1dell · powerprotect data domain management center · CWE-89 SQL injection	Critical9.6	—	0.3%	Oct 28, 2026
38Monitor	CVE-2026-103799No exploit	Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1dell · powerprotect data domain management center · CWE-862 Broken access control (IDOR)	Critical9.6	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-110540No exploit	Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1dell · powerprotect data domain management center · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Oct 28, 2026
29Monitor	CVE-2026-110541No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-78 RCE Command injection	High7.2	—	1.8%	Oct 28, 2026
37Monitor	CVE-2026-112197No exploit	Missing Authentication for Critical Function in Tactis' NoviGest Desktop Apptactis · novigest desktop app · CWE-306 RCE Auth bypass	Critical9.4	—	0.3%	Oct 28, 2026
33Monitor	CVE-2026-112198No exploit	Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop Apptactis · novigest desktop app · CWE-611 Local privilege escalation XXE	High8.3	—	0.1%	Oct 28, 2026
29Monitor	CVE-2026-6064No exploit	Norton, Avast, and AVG local privilege escalation via link following in Data Shreddergen digital · norton antivirus · CWE-59 Local privilege escalation	High7.3	—	0.1%	Oct 28, 2026
30Monitor	CVE-2026-86377No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-787 Memory safety	High7.6	—	0.3%	Oct 28, 2026
35Monitor	CVE-2026-86378No exploit	Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 redell · powerprotect data domain · CWE-121 Memory safety	High8.8	—	0.3%	Oct 28, 2026
29Monitor	CVE-2026-87102No exploit	Sensitive information disclosure and manipulation due to improper token validation.acronis · acronis cyber protect 17 · CWE-347 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 28, 2026
29Monitor	CVE-2026-87103No exploit	Sensitive information disclosure and manipulation due to improper token validation.acronis · acronis cyber protect 17 · CWE-347 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 28, 2026
31Monitor	CVE-2026-99107No exploit	ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resizelinux · linux	High7.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99109No exploit	smb: client: reject SetEA requests that do not fit the request bufferlinux · linux	High7.8	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-99110No exploit	smb: client: fix heap overflow in cifs_do_set_acl()linux · linux	High7.0	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-99112No exploit	net/sched: cls_flower: validate mask pointer after nla_next()linux · linux	High7.1	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99116No exploit	net: psp: do not inherit the Rx association on clonelinux · linux	High7.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99117No exploit	net: bridge: mcast: don't truncate the port group walk on teardownlinux · linux	High7.8	—	0.1%	Oct 28, 2026
29Monitor	CVE-2026-99122No exploit	vsock/vmci: validate packet source for connected socketslinux · linux	High7.3	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-99123No exploit	vsock/virtio: validate packet source for connected socketslinux · linux	High7.1	—	0.1%	Oct 28, 2026
32Monitor	CVE-2026-99131No exploit	xfs: fix capability check in xfslinux · linux Pre-auth	High8.2	—	0.4%	Oct 28, 2026
28Monitor	CVE-2026-99136No exploit	dm-crypt: fix a tiny race condition in crypt_dec_pendinglinux · linux Race condition	High7.0	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-99142No exploit	tracing: Check operator stack capacity before pushinglinux · linux	High7.1	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99143No exploit	tracing: Keep the predicate limit separate from program capacitylinux · linux	High7.8	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-99148No exploit	drm/amdgpu: keep the eviction fence until the last handle is closedlinux · linux	High7.0	—	0.1%	Oct 28, 2026
30Monitor	CVE-2026-99152No exploit	scsi: libiscsi: Validate the task named by a management responselinux · linux Pre-auth Denial of service	High7.5	—	0.5%	Oct 28, 2026
39Monitor	CVE-2026-99153No exploit	scsi: libiscsi: Validate the ITT reflected in a Reject PDUlinux · linux Pre-auth	Critical9.8	—	0.5%	Oct 28, 2026
39Monitor	CVE-2026-99154No exploit	scsi: libiscsi: Reject a negative task index from parse_pdu_ittlinux · linux Pre-auth	Critical9.8	—	0.5%	Oct 28, 2026
31Monitor	CVE-2026-99156No exploit	scsi: st: Fix use-after-free race between st_remove() and st_open()linux · linux	High7.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99163No exploit	tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fieldslinux · linux	High7.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99164No exploit	spi: imx: fix slab corruption from undersized DMA bounce bufferslinux · linux	High7.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99167No exploit	net/sched: fix use-after-free in __tcf_action_put()linux · linux	High7.8	—	0.1%	Oct 28, 2026
35Monitor	CVE-2026-99170No exploit	namespace: a mount that copy_tree() leaves out can't take over a locklinux · linux	High8.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99173No exploit	eventfs: Free the eventfs_inode after an rcu grace period toolinux · linux	High7.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99177No exploit	KVM: SEV: Fix page dirtying in sev_gmem_post_populate()linux · linux	High7.8	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99180No exploit	unicode: free the map after a grace periodlinux · linux	High7.8	—	0.1%	Oct 28, 2026
35Monitor	CVE-2026-99185No exploit	firewire: core: fix race condition in split transaction handlinglinux · linux Pre-auth Race condition	High8.8	—	0.2%	Oct 28, 2026
31Monitor	CVE-2026-99203No exploit	pipe: preserve existing fasync readers on writer setup failurelinux · linux Local privilege escalation	High7.8	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-99212No exploit	net/rds: don't let the rdma_cm destroy an id RDS still owns on route failurelinux · linux	High7.0	—	0.1%	Oct 28, 2026
31Monitor	CVE-2026-99213No exploit	vsock: treat TCP_CLOSING as once-establishedlinux · linux	High7.8	—	0.1%	Oct 28, 2026
33Monitor	CVE-2026-99216No exploit	Drivers: hv: Don't reset VMBus connection state on error/exit pathslinux · linux	High8.4	—	0.1%	Oct 28, 2026
30Monitor	GHSA-34cw-x8g7-rcv5No exploit	Stack overflow on deeply nested GraphQL documents Pre-auth Denial of service	High7.5	—	—	Oct 28, 2026
30Monitor	GHSA-36rq-8957-mjrxNo exploit	Excessive CPU and memory use on crafted GraphQL documents Pre-auth Denial of service	High7.5	—	—	Oct 28, 2026
30Monitor	GHSA-pfrg-qg4f-grmvNo exploit	Unbounded memory use on large request bodies Pre-auth Denial of service	High7.5	—	—	Oct 28, 2026
30Monitor	RUSTSEC-2026-0433No exploit	Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS` Pre-auth Denial of service	High7.5	—	—	Oct 28, 2026
30Monitor	RUSTSEC-2026-0436No exploit	Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input Pre-auth Denial of service	High7.5	—	—	Oct 28, 2026
34Monitor	CVE-2026-102790No exploit	Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12icagenda.com · icagenda extension for joomla · CWE-79 XSS	High8.6	—	0.2%	Oct 28, 2026
39Monitor	CVE-2026-114278No exploit	Unauthenticated Command Injection via kubeconfig Username in che-machine-exececlipse foundation · eclipse che · CWE-78 pre-auth RCE Command injection	Critical9.8	—	0.8%	Oct 28, 2026
34Monitor	CVE-2026-118477No exploit	KaliFast Project Management Platform ei_git_repo_url OS Command Injectioneisge · kalifast · CWE-78 RCE Command injection	High8.7	—	1.1%	Oct 28, 2026
28Monitor	CVE-2026-118485No exploit	Axel Download Accelerator Path Traversal via URL Filename Decodingaxel download accelerator · axel · CWE-24 Pre-auth Path traversal	High7.0	—	0.5%	Oct 28, 2026
37Monitor	CVE-2026-111411No exploit	WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerabilityaman · funnelkit automations · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-111850No exploit	WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerabilitybuddypress · buddypress · CWE-89 SQL injection	High8.5	—	0.2%	Oct 28, 2026
30Monitor	CVE-2026-115591No exploit	WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerabilitysupsystic · contact form by supsystic · CWE-201 Pre-auth	High7.5	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-115593No exploit	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 28, 2026
28Monitor	CVE-2026-115596Proof of concept	WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerabilityimplecode · ecommerce product catalog · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 28, 2026
28Monitor	CVE-2026-115606No exploit	WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilitycrowd favorite · dxp toolkit · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 28, 2026
37Monitor	CVE-2026-115607No exploit	WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerabilitycrowd favorite · dxp toolkit · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 28, 2026
28Monitor	CVE-2026-115609No exploit	WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerabilitystiofan · getpaid · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 28, 2026

CVE-2026-118374
32Monitor
LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
openbsd · libresslOct 28, 2026
CVE-2026-118375
36Monitor
llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Memory safety
ggml-org · llama.cppOct 28, 2026
CVE-2026-118377
34Monitor
mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
mewebstudio · posOct 28, 2026
CVE-2026-118378
34Monitor
Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
tabularisdb · tabularisOct 28, 2026
CVE-2026-84999
39Monitor
Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
pie register · pie register premiumOct 28, 2026
CVE-2026-97019
28Monitor
AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
mohammed_kaludi · amp for wp – accelerated mobile pagesOct 28, 2026
CVE-2026-111255
30Monitor
affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
HighCVSS 7.5No exploitEPSS 0%
- RCE
- File upload
cservit · affiliate-toolkit – multi-network affiliate & amazon product displayOct 28, 2026
CVE-2026-116613
30Monitor
Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
bplugins · animated text block – add typing and looping text effectsOct 28, 2026
CVE-2026-1928
35Monitor
Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
rankmath · rank math seo – ai seo tools to dominate seo rankingsOct 28, 2026
CVE-2026-104383
37Monitor
Code injection in EagleCloud Aquila on-premises version
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
eaglecloud · aquilaOct 28, 2026
CVE-2026-104384
34Monitor
Insufficiently protected credentials in EagleCloud Aquila on-premises version
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
eaglecloud · aquilaOct 28, 2026
CVE-2026-103688
39Monitor
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
unknown · checkout files upload for woocommerceOct 28, 2026
CVE-2026-105972
30Monitor
WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · menu cart for woocommerceOct 28, 2026
CVE-2026-111021
28Monitor
Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · افزونه پیامک ووکامرس | persian woocommerce smsOct 28, 2026
CVE-2026-111577
28Monitor
GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings
HighCVSS 7.2No exploitEPSS 0%
unknown · gosmtpOct 28, 2026
CVE-2026-111967
27Monitor
MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
MediumCVSS 6.8Proof of conceptEPSS 0%
- XSS
unknown · mp3 audio playerOct 28, 2026
CVE-2026-15323
30Monitor
Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
king-theme · product designer for woocommerce wordpress | lumiseOct 28, 2026
CVE-2026-109218
39Monitor
Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
kleor · contact managerOct 28, 2026
CVE-2026-109381
28Monitor
Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
HighCVSS 7.2No exploitEPSS 0%
magepeopleteam · event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendarOct 28, 2026
CVE-2026-109384
35Monitor
The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multip
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- File upload
melograno · the innovative form builder – ivyformsOct 28, 2026
CVE-2026-110662
28Monitor
MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
mxchat · mxchat – ai chatbot & content generation for wordpressOct 28, 2026
CVE-2026-111111
28Monitor
Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
bdthemes · prime slider – hero slider, carousel, woocommerce & post slider elementor addonsOct 28, 2026
CVE-2026-111120
35Monitor
VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- CSRF
e4jvikwp · vikrentcar car rental management systemOct 28, 2026
CVE-2026-63286
28Monitor
Database backups are vulnerable to offline attacks.
HighCVSS 7.1Proof of conceptEPSS 0%
- Weak crypto
axis communications ab · axis camera station proOct 28, 2026
CVE-2026-92797
35Monitor
Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
memberpress · memberpressOct 28, 2026
CVE-2026-86395
29Monitor
Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · powerprotect data domain virtual editionOct 28, 2026
CVE-2026-86396
36Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
dell · powerprotect data domainOct 28, 2026
CVE-2026-86397
39Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
dell · powerprotect data domainOct 28, 2026
CVE-2026-86398
35Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 8.8No exploitEPSS 0%
- Path traversal
dell · powerprotect data domainOct 28, 2026
CVE-2026-86399
29Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · powerprotect data domainOct 28, 2026
CVE-2026-86400
39Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
dell · powerprotect data domainOct 28, 2026
CVE-2026-90717
36Monitor
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1
CriticalCVSS 9.1No exploitEPSS 0%
- Auth bypass
dell · powerprotect data domain management centerOct 28, 2026
CVE-2026-14571
36Monitor
SQL injection (SQLi) in the user authentication module of Futurum Software
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
- SQL injection
futurum software · futurum software user authentication moduleOct 28, 2026
CVE-2026-86379
29Monitor
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · powerprotect data domain management centerOct 28, 2026
CVE-2026-86380
28Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 7.2No exploitEPSS 0%
- Memory safety
dell · powerprotect data domainOct 28, 2026
CVE-2026-86384
39Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
dell · powerprotect data domainOct 28, 2026
CVE-2026-86385
35Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability.
HighCVSS 8.8No exploitEPSS 0%
dell · powerprotect data domainOct 28, 2026
CVE-2026-86389
28Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 7.2No exploitEPSS 0%
- Memory safety
dell · powerprotect data domainOct 28, 2026
CVE-2026-86393
28Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 7.2No exploitEPSS 0%
dell · powerprotect data domainOct 28, 2026
CVE-2026-86394
29Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · powerprotect data domainOct 28, 2026
CVE-2025-30414
28Monitor
Local privilege escalation due to improper authentication.
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
- Local privilege escalation
acronis · acronis cyber protect cloud agentOct 28, 2026
CVE-2026-103779
33Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 8.3No exploitEPSS 0%
- Auth bypass
dell · powerprotect data domainOct 28, 2026
CVE-2026-103780
39Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
dell · powerprotect data domainOct 28, 2026
CVE-2026-103792
38Monitor
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1
CriticalCVSS 9.6No exploitEPSS 0%
- SQL injection
dell · powerprotect data domain management centerOct 28, 2026
CVE-2026-103799
38Monitor
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1
CriticalCVSS 9.6No exploitEPSS 0%
- Broken access control (IDOR)
dell · powerprotect data domain management centerOct 28, 2026
CVE-2026-110540
28Monitor
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dell · powerprotect data domain management centerOct 28, 2026
CVE-2026-110541
29Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Command injection
dell · powerprotect data domainOct 28, 2026
CVE-2026-112197
37Monitor
Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Auth bypass
tactis · novigest desktop appOct 28, 2026
CVE-2026-112198
33Monitor
Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
HighCVSS 8.3No exploitEPSS 0%
- Local privilege escalation
- XXE
tactis · novigest desktop appOct 28, 2026
CVE-2026-6064
29Monitor
Norton, Avast, and AVG local privilege escalation via link following in Data Shredder
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
gen digital · norton antivirusOct 28, 2026
CVE-2026-86377
30Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 7.6No exploitEPSS 0%
- Memory safety
dell · powerprotect data domainOct 28, 2026
CVE-2026-86378
35Monitor
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
dell · powerprotect data domainOct 28, 2026
CVE-2026-87102
29Monitor
Sensitive information disclosure and manipulation due to improper token validation.
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
acronis · acronis cyber protect 17Oct 28, 2026
CVE-2026-87103
29Monitor
Sensitive information disclosure and manipulation due to improper token validation.
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
acronis · acronis cyber protect 17Oct 28, 2026
CVE-2026-99107
31Monitor
ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99109
31Monitor
smb: client: reject SetEA requests that do not fit the request buffer
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99110
28Monitor
smb: client: fix heap overflow in cifs_do_set_acl()
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99112
28Monitor
net/sched: cls_flower: validate mask pointer after nla_next()
HighCVSS 7.1No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99116
31Monitor
net: psp: do not inherit the Rx association on clone
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99117
31Monitor
net: bridge: mcast: don't truncate the port group walk on teardown
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99122
29Monitor
vsock/vmci: validate packet source for connected sockets
HighCVSS 7.3No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99123
28Monitor
vsock/virtio: validate packet source for connected sockets
HighCVSS 7.1No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99131
32Monitor
xfs: fix capability check in xfs
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
linux · linuxOct 28, 2026
CVE-2026-99136
28Monitor
dm-crypt: fix a tiny race condition in crypt_dec_pending
HighCVSS 7.0No exploitEPSS 0%
- Race condition
linux · linuxOct 28, 2026
CVE-2026-99142
28Monitor
tracing: Check operator stack capacity before pushing
HighCVSS 7.1No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99143
31Monitor
tracing: Keep the predicate limit separate from program capacity
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99148
28Monitor
drm/amdgpu: keep the eviction fence until the last handle is closed
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99152
30Monitor
scsi: libiscsi: Validate the task named by a management response
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxOct 28, 2026
CVE-2026-99153
39Monitor
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 28, 2026
CVE-2026-99154
39Monitor
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 28, 2026
CVE-2026-99156
31Monitor
scsi: st: Fix use-after-free race between st_remove() and st_open()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99163
31Monitor
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99164
31Monitor
spi: imx: fix slab corruption from undersized DMA bounce buffers
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99167
31Monitor
net/sched: fix use-after-free in __tcf_action_put()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99170
35Monitor
namespace: a mount that copy_tree() leaves out can't take over a lock
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99173
31Monitor
eventfs: Free the eventfs_inode after an rcu grace period too
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99177
31Monitor
KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99180
31Monitor
unicode: free the map after a grace period
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99185
35Monitor
firewire: core: fix race condition in split transaction handling
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Race condition
linux · linuxOct 28, 2026
CVE-2026-99203
31Monitor
pipe: preserve existing fasync readers on writer setup failure
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxOct 28, 2026
CVE-2026-99212
28Monitor
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99213
31Monitor
vsock: treat TCP_CLOSING as once-established
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 28, 2026
CVE-2026-99216
33Monitor
Drivers: hv: Don't reset VMBus connection state on error/exit paths
HighCVSS 8.4No exploitEPSS 0%
linux · linuxOct 28, 2026
GHSA-34cw-x8g7-rcv5
30Monitor
Stack overflow on deeply nested GraphQL documents
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 28, 2026
GHSA-36rq-8957-mjrx
30Monitor
Excessive CPU and memory use on crafted GraphQL documents
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 28, 2026
GHSA-pfrg-qg4f-grmv
30Monitor
Unbounded memory use on large request bodies
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 28, 2026
RUSTSEC-2026-0433
30Monitor
Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 28, 2026
RUSTSEC-2026-0436
30Monitor
Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 28, 2026
CVE-2026-102790
34Monitor
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
HighCVSS 8.6No exploitEPSS 0%
- XSS
icagenda.com · icagenda extension for joomlaOct 28, 2026
CVE-2026-114278
39Monitor
Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
eclipse foundation · eclipse cheOct 28, 2026
CVE-2026-118477
34Monitor
KaliFast Project Management Platform ei_git_repo_url OS Command Injection
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Command injection
eisge · kalifastOct 28, 2026
CVE-2026-118485
28Monitor
Axel Download Accelerator Path Traversal via URL Filename Decoding
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Path traversal
axel download accelerator · axelOct 28, 2026
CVE-2026-111411
37Monitor
WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
aman · funnelkit automationsOct 28, 2026
CVE-2026-111850
34Monitor
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
buddypress · buddypressOct 28, 2026
CVE-2026-115591
30Monitor
WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
supsystic · contact form by supsysticOct 28, 2026
CVE-2026-115593
28Monitor
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unlimited elements · unlimited elements for elementor (free widgets, addons, templates)Oct 28, 2026
CVE-2026-115596
28Monitor
WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
implecode · ecommerce product catalogOct 28, 2026
CVE-2026-115606
28Monitor
WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crowd favorite · dxp toolkitOct 28, 2026
CVE-2026-115607
37Monitor
WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
crowd favorite · dxp toolkitOct 28, 2026
CVE-2026-115609
28Monitor
WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
stiofan · getpaidOct 28, 2026