By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 81 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-116285No exploit	HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodiesCWE-1333 Pre-auth Denial of service	High7.5	—	0.3%	Oct 28, 2026
36Monitor	CVE-2026-116531No exploit	HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunkCWE-130 Pre-auth	Critical9.1	—	0.4%	Oct 28, 2026
33Monitor	CVE-2026-116794No exploit	russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationeugeny · russh · CWE-862 Broken access control (IDOR)	High8.3	—	0.1%	Oct 28, 2026
30Monitor	CVE-2026-116795No exploit	RE2JS: Quadratic-time denial of service in re2js lookbehind matchingle0pard · re2js · CWE-407 Pre-auth Denial of service	High7.5	—	0.4%	Oct 28, 2026
28Monitor	CVE-2026-116796No exploit	Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartshighcharts · highcharts · CWE-79 XSS	High7.2	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-116797No exploit	Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`highcharts · highcharts · CWE-79 XSS	High8.5	—	0.3%	Oct 28, 2026
30Monitor	CVE-2026-117500No exploit	HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart uploadCWE-1333 Pre-auth Denial of service	High7.5	—	0.4%	Oct 28, 2026
30Monitor	CVE-2026-117501No exploit	HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodiesCWE-770 Pre-auth Denial of service	High7.5	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-118242No exploit	Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`highcharts · highcharts · CWE-79 XSS	High8.5	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-118244No exploit	Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printhighcharts · highcharts · CWE-79 XSS	High7.2	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-118245No exploit	Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespacehighcharts · highcharts · CWE-79 XSS	High8.6	—	0.3%	Oct 28, 2026
33Monitor	CVE-2026-118246No exploit	Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributeshighcharts · highcharts · CWE-79 XSS	High8.4	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-118249No exploit	Highcharts: series column construction writes to Object.prototypehighcharts · highcharts · CWE-1321 Prototype pollution	High7.2	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-118250No exploit	Highcharts: dotted series.keys paths write to Object.prototypehighcharts · highcharts · CWE-1321 Prototype pollution	High7.2	—	0.3%	Oct 28, 2026
32Monitor	CVE-2026-84725No exploit	Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eapred hat · red hat jboss enterprise application platform 7 · CWE-829 Pre-auth	High8.1	—	0.4%	Oct 28, 2026
33Monitor	CVE-2026-118251No exploit	Highcharts: javascript: URL in credits.href runs script on clickhighcharts · highcharts · CWE-79 XSS	High8.4	—	0.4%	Oct 28, 2026
33Monitor	CVE-2026-118252No exploit	Highcharts Dashboards: sidebar component labels are parsed as HTMLhighcharts · highcharts · CWE-79 XSS	High8.4	—	0.4%	Oct 28, 2026
33Monitor	CVE-2026-118253No exploit	Highcharts Dashboards: fullscreen labels are parsed as HTMLhighcharts · highcharts · CWE-79 XSS	High8.4	—	0.4%	Oct 28, 2026
34Monitor	CVE-2026-118254No exploit	Highcharts Grid: pagination language options are parsed as HTMLhighcharts · highcharts · CWE-79 XSS	High8.6	—	0.4%	Oct 28, 2026
33Monitor	CVE-2026-118255No exploit	Highcharts Grid: javascript: URL in credits.href runs script on clickhighcharts · highcharts · CWE-79 XSS	High8.4	—	0.3%	Oct 28, 2026
28Monitor	CVE-2026-118257No exploit	Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesintlify · vue-i18n · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 28, 2026
32Monitor	CVE-2026-118260No exploit	Echo: BodyDump captures request and response bodies without size limits in v4labstack · echo · CWE-400 Pre-auth Denial of service	High8.2	—	0.3%	Oct 28, 2026
32Monitor	CVE-2026-118261No exploit	Echo: Decompress permits unbounded gzip expansion in v4labstack · echo · CWE-400 Pre-auth Denial of service	High8.2	—	0.3%	Oct 28, 2026
32Monitor	CVE-2026-118262No exploit	Echo: WebSocket proxy can retain connections and handlers after client disconnectlabstack · echo · CWE-772 Pre-auth	High8.2	—	0.3%	Oct 28, 2026
36Monitor	CVE-2026-118264No exploit	Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlslabstack · echo · CWE-444 Pre-auth Auth bypass	Critical9.1	—	0.4%	Oct 28, 2026
36Monitor	CVE-2026-118633No exploit	A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) aftersophos · sg utm · CWE-35 pre-auth RCE Path traversal Race condition	Critical9.2	—	0.5%	Oct 28, 2026
28Monitor	CVE-2026-118645No exploit	n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parametern8n-io · n8n · CWE-943 Pre-auth SQL injection	High7.0	—	0.2%	Oct 28, 2026
28Monitor	CVE-2026-118646No exploit	n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Noden8n-io · n8n · CWE-1333 Denial of service	High7.1	—	0.2%	Oct 28, 2026
33Monitor	CVE-2026-118648No exploit	n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policyn8n-io · n8n · CWE-79 XSS	High8.4	—	0.2%	Oct 28, 2026
34Monitor	CVE-2026-118649No exploit	n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tablesn8n-io · n8n · CWE-1321 Prototype pollution	High8.7	—	0.2%	Oct 28, 2026
28Monitor	CVE-2026-118678No exploit	n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compactionn8n-io · n8n · CWE-1321 Prototype pollution	High7.1	—	0.2%	Oct 28, 2026
34Monitor	CVE-2026-118683No exploit	MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.confproject-monai · monai · CWE-94 pre-auth RCE	High8.6	—	0.4%	Oct 28, 2026
32Monitor	CVE-2026-118684No exploit	MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloadsproject-monai · monai · CWE-327 Pre-auth Weak crypto	High8.2	—	0.1%	Oct 28, 2026
34Monitor	CVE-2026-118686No exploit	EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regexespocrm · espocrm · CWE-1333 Pre-auth Denial of service	High8.7	—	0.3%	Oct 28, 2026
33Monitor	CVE-2026-118687No exploit	Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authenticationcoder · coder · CWE-441 Pre-auth	High8.3	—	0.1%	Oct 28, 2026
35Monitor	CVE-2026-118688No exploit	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Renamebytecodealliance · wasmtime · CWE-61	High8.8	—	0.2%	Oct 28, 2026
30Monitor	GHSA-7w82-6f9j-v9jpNo exploit	mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute PathsCWE-22 Pre-auth Path traversal	High7.5	—	—	Oct 28, 2026
32Monitor	GHSA-4mfg-r38w-w8fgNo exploit	mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6CWE-918 Pre-auth SSRF	High8.2	—	—	Oct 28, 2026
33Monitor	CVE-2025-14260No exploit	Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resourceswso2 · wso2 api manager · CWE-918 SSRF	High8.3	—	0.2%	Oct 28, 2026
32Monitor	CVE-2026-109411No exploit	Samba: access control bypass via vfs_ceph_rgw case-insensitive opensamba · samba · CWE-178	High8.1	—	0.6%	Oct 28, 2026
36Monitor	CVE-2026-117574No exploit	Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorizationred hat · red hat openshift ai (rhoai) · CWE-639 Broken access control (IDOR)	Critical9.1	—	0.2%	Oct 28, 2026
30Monitor	CVE-2026-118650Proof of concept	Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathlabstack · echo · CWE-177 Pre-auth	High7.5	—	0.3%	Oct 28, 2026
30Monitor	CVE-2026-13451No exploit	Kserve: kserve: server-side request forgery via malicious storageurired hat · red hat openshift ai (rhoai) · CWE-918 SSRF	High7.7	—	0.2%	Oct 28, 2026
34Monitor	CVE-2026-61542No exploit	Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP toolsdrhelius · gearboy · CWE-306 Pre-auth Auth bypass	High8.6	—	0.3%	Oct 28, 2026
37Monitor	CVE-2026-63190No exploit	FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSSfearlessgeekmedia · fearlesscms · CWE-22 Pre-auth Path traversal XSS	Critical9.4	—	0.5%	Oct 28, 2026
29Monitor	CVE-2026-6647No exploit	Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Eventswso2 · wso2 identity server · CWE-613	High7.4	—	0.2%	Oct 28, 2026
64This week	CVE-2026-76418Weaponized	Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerabilitycisco · adaptive security appliance software · CWE-690 Pre-auth Denial of service	High8.6	KEV	0.8%	Oct 28, 2026
35Monitor	CVE-2026-78674No exploit	Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Executionwso2 · enterprise integrator (bps profile) · CWE-78 RCE Command injection	High8.8	—	0.9%	Oct 28, 2026
30Monitor	CVE-2026-118659No exploit	@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxycapricorn86 · happy-dom · CWE-918 Pre-auth SSRF	High7.5	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-118660No exploit	Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLcapricorn86 · happy-dom · CWE-918 Pre-auth SSRF	High8.6	—	0.4%	Oct 28, 2026
32Monitor	CVE-2026-118664No exploit	decode-uri-component: Denial of service via quadratic replacement of percent-encoded runssamverschueren · decode-uri-component · CWE-400 Pre-auth Denial of service	High8.2	—	0.3%	Oct 28, 2026
32Monitor	CVE-2026-118665No exploit	GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsardatan · graphql-tools · CWE-613 Pre-auth	High8.2	—	0.3%	Oct 28, 2026
34Monitor	CVE-2026-118668No exploit	LangGraph JavaScript custom authentication may permit cross-user Store accesslangchain-ai · langgraph-api · CWE-639 Broken access control (IDOR)	High8.6	—	0.3%	Oct 28, 2026
30Monitor	CVE-2026-116641No exploit	The DB Tools trust certificates issued by recoverable eMudhra intermediate CAsmongodb · database tools · CWE-295 Pre-auth Weak crypto	High7.6	—	0.1%	Oct 28, 2026
33Monitor	CVE-2026-118669Proof of concept	OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientoauthlib · oauthlib · CWE-863 Broken access control (IDOR)	High8.4	—	0.3%	Oct 28, 2026
30Monitor	CVE-2026-118682No exploit	ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITMkaringx · clashmi · CWE-295 Pre-auth Weak crypto	High7.7	—	0.2%	Oct 28, 2026
34Monitor	CVE-2026-118689No exploit	OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_lengthovenmedialabs · ovenmediaengine · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Oct 28, 2026
37Monitor	CVE-2026-118690No exploit	Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogssignalk · signalk-server · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.6%	Oct 28, 2026
28Monitor	CVE-2026-118692No exploit	CherryTree through 1.7.2 OS Command Injection via Custom Web Link Actiongiuspen · cherrytree · CWE-78 RCE Command injection	High7.1	—	0.5%	Oct 28, 2026
34Monitor	CVE-2026-118694No exploit	python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinationstrentm · python-markdown2 · CWE-407 Pre-auth	High8.7	—	0.4%	Oct 28, 2026
34Monitor	CVE-2026-118752No exploit	FreeImage through 3.18.0 and danoli3 fork before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoderdanoli3 · freeimage · CWE-787 Memory safety	High8.5	—	0.1%	Oct 28, 2026
34Monitor	CVE-2026-118753No exploit	FreeImage through 3.18.0 and danoli3 fork before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositingdanoli3 · freeimage · CWE-787 Memory safety	High8.5	—	0.1%	Oct 28, 2026
34Monitor	CVE-2026-118755No exploit	Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Pathvolmarg · personal-management-system · CWE-78 RCE Command injection	High8.6	—	1.4%	Oct 28, 2026
30Monitor	CVE-2026-118803No exploit	Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_resultbricks · bricks theme · CWE-1336 pre-auth RCE Auth bypass SSTI	High7.5	—	0.3%	Oct 28, 2026
30Monitor	CVE-2026-118804No exploit	Bricks Broken Access Control via query_result Endpointbricks · bricks builder · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 28, 2026
28Monitor	CVE-2026-54453No exploit	OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)opencats · opencats · CWE-74 RCE	High7.2	—	0.4%	Oct 28, 2026
30Monitor	CVE-2026-54455No exploit	OpenCATS: Authenticated SQL injection in activity DataGrid date filtersopencats · opencats · CWE-20 SQL injection	High7.6	—	0.2%	Oct 28, 2026
35Monitor	CVE-2026-61546No exploit	AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP toolsankimcp · anki-mcp-server-addon · CWE-346 Pre-auth	High8.8	—	0.1%	Oct 28, 2026
40Plan	CVE-2026-61564No exploit	AVideo-Encoder: unauthenticated installer PHP code injectionwwbn · avideo-encoder · CWE-94 pre-auth RCE	Critical10.0	—	0.5%	Oct 28, 2026
40Plan	CVE-2026-61567No exploit	AVideo-Encoder: unauthenticated command execution through streamer login trustwwbn · avideo-encoder · CWE-78 pre-auth RCE Command injection	Critical10.0	—	0.5%	Oct 28, 2026
30Monitor	CVE-2026-61569No exploit	AVideo-Encoder: pre-authentication streamer-login SQL injectionwwbn · avideo-encoder · CWE-89 Pre-auth SQL injection	High7.5	—	0.2%	Oct 28, 2026
29Monitor	CVE-2026-61571No exploit	AVideo-Encoder: missing authentication on control and status endpointswwbn · avideo-encoder · CWE-306 Pre-auth Auth bypass	High7.3	—	0.2%	Oct 28, 2026
34Monitor	CVE-2026-61572No exploit	AVideo-Encoder: unauthenticated full-response server-side request forgerywwbn · avideo-encoder · CWE-918 Pre-auth SSRF	High8.6	—	0.2%	Oct 28, 2026
32Monitor	CVE-2026-93851No exploit	Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted postmattermost · mattermost · CWE-22 Path traversal	High8.0	—	0.2%	Oct 28, 2026
35Monitor	CVE-2026-118579No exploit	D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoord-link · dir-505 · CWE-912 Pre-auth	High8.9	—	0.7%	Oct 28, 2026
32Monitor	CVE-2026-85749No exploit	MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mailmailwatch · mailwatch · CWE-566 Broken access control (IDOR) CSRF	High8.1	—	0.2%	Oct 28, 2026
33Monitor	CVE-2026-21157No exploit	Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.samsung mobile · bixby · CWE-20 Local privilege escalation	High8.3	—	0.1%	Oct 29, 2026
34Monitor	CVE-2026-113387No exploit	The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public canva · ortto · CWE-306 Pre-auth Auth bypass	High8.6	—	0.2%	Oct 29, 2026
37Monitor	CVE-2026-66088No exploit	Unrestricted Command Execution via system.executeapereo foundation · openequella · CWE-78 RCE Command injection	Critical9.4	—	0.6%	Oct 29, 2026
28Monitor	CVE-2026-66090No exploit	XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Readapereo foundation · openequella · CWE-611 SSRF XXE	High7.1	—	0.2%	Oct 29, 2026
39Monitor	CVE-2026-109516No exploit	Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Tokenguruteam · bot for telegram on woocommerce · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 29, 2026
39Monitor	CVE-2026-42922No exploit	A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).frangoteam · frangoteam · CWE-285 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.5%	Oct 29, 2026
30Monitor	CVE-2026-93757No exploit	Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisitewild-apricot · wild apricot login · CWE-287 Auth bypass	High7.5	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-93855No exploit	SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameterbrewlabs · sendpress newsletters · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-93904No exploit	Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameterdejanmarkovic · social web suite – social media auto post, social media auto publish · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	Oct 29, 2026
32Monitor	CVE-2026-96228No exploit	SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeoversslplugins · ssl wireless sms notification · CWE-287 Pre-auth Auth bypass	High8.1	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-96666No exploit	Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filtervberkel · schema app structured data · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-96669No exploit	Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookiewpscripts · food store – online food delivery & pickup · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 29, 2026
28Monitor	CVE-2026-96741No exploit	DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruptionmlfactory · dsgvo all in one for wp · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 29, 2026
36Monitor	CVE-2026-103693No exploit	Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injectionunknown · frontend dashboard · CWE-502 pre-auth RCE Deserialization	Critical9.0	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-111739No exploit	Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameterunknown · two factor authentication · CWE-287 Auth bypass	High7.5	—	0.2%	Oct 29, 2026
39Monitor	CVE-2026-113616No exploit	LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Resetunknown · logixfast auth · CWE-269 Pre-auth	Critical9.8	—	0.3%	Oct 29, 2026
39Monitor	CVE-2026-113617No exploit	Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversalunknown · automated import products to cart · CWE-22 Path traversal	Critical9.9	—	0.3%	Oct 29, 2026
29Monitor	CVE-2026-114488No exploit	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingred hat · red hat fuse 7 · CWE-829 Pre-auth Auth bypass	High7.4	—	0.4%	Oct 29, 2026
39Monitor	CVE-2026-115245No exploit	Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Uploadunknown · chat ai with dispatcher · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-115301No exploit	Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Blockunknown · contact form by supsystic · CWE-94 RCE SSTI	High7.2	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-118905No exploit	nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sednvm-sh · nvm · CWE-78 RCE Command injection	High7.1	—	0.1%	Oct 29, 2026
29Monitor	CVE-2026-15564No exploit	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserializationred hat · red hat jboss enterprise application platform 7 · CWE-829 Deserialization	High7.4	—	0.1%	Oct 29, 2026
35Monitor	CVE-2026-86794No exploit	Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Formunknown · community events · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 29, 2026
34Monitor	CVE-2026-89216No exploit	vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameterunknown · vtables · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 29, 2026

CVE-2026-116285
30Monitor
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 28, 2026
CVE-2026-116531
36Monitor
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 28, 2026
CVE-2026-116794
33Monitor
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
eugeny · russhOct 28, 2026
CVE-2026-116795
30Monitor
RE2JS: Quadratic-time denial of service in re2js lookbehind matching
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
le0pard · re2jsOct 28, 2026
CVE-2026-116796
28Monitor
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
HighCVSS 7.2No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-116797
34Monitor
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
HighCVSS 8.5No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-117500
30Monitor
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 28, 2026
CVE-2026-117501
30Monitor
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 28, 2026
CVE-2026-118242
34Monitor
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
HighCVSS 8.5No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118244
28Monitor
Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print
HighCVSS 7.2No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118245
34Monitor
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
HighCVSS 8.6No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118246
33Monitor
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
HighCVSS 8.4No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118249
28Monitor
Highcharts: series column construction writes to Object.prototype
HighCVSS 7.2No exploitEPSS 0%
- Prototype pollution
highcharts · highchartsOct 28, 2026
CVE-2026-118250
28Monitor
Highcharts: dotted series.keys paths write to Object.prototype
HighCVSS 7.2No exploitEPSS 0%
- Prototype pollution
highcharts · highchartsOct 28, 2026
CVE-2026-84725
32Monitor
Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
red hat · red hat jboss enterprise application platform 7Oct 28, 2026
CVE-2026-118251
33Monitor
Highcharts: javascript: URL in credits.href runs script on click
HighCVSS 8.4No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118252
33Monitor
Highcharts Dashboards: sidebar component labels are parsed as HTML
HighCVSS 8.4No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118253
33Monitor
Highcharts Dashboards: fullscreen labels are parsed as HTML
HighCVSS 8.4No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118254
34Monitor
Highcharts Grid: pagination language options are parsed as HTML
HighCVSS 8.6No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118255
33Monitor
Highcharts Grid: javascript: URL in credits.href runs script on click
HighCVSS 8.4No exploitEPSS 0%
- XSS
highcharts · highchartsOct 28, 2026
CVE-2026-118257
28Monitor
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
intlify · vue-i18nOct 28, 2026
CVE-2026-118260
32Monitor
Echo: BodyDump captures request and response bodies without size limits in v4
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
labstack · echoOct 28, 2026
CVE-2026-118261
32Monitor
Echo: Decompress permits unbounded gzip expansion in v4
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
labstack · echoOct 28, 2026
CVE-2026-118262
32Monitor
Echo: WebSocket proxy can retain connections and handlers after client disconnect
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
labstack · echoOct 28, 2026
CVE-2026-118264
36Monitor
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
labstack · echoOct 28, 2026
CVE-2026-118633
36Monitor
A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Path traversal
- Race condition
sophos · sg utmOct 28, 2026
CVE-2026-118645
28Monitor
n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- SQL injection
n8n-io · n8nOct 28, 2026
CVE-2026-118646
28Monitor
n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
n8n-io · n8nOct 28, 2026
CVE-2026-118648
33Monitor
n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
HighCVSS 8.4No exploitEPSS 0%
- XSS
n8n-io · n8nOct 28, 2026
CVE-2026-118649
34Monitor
n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
HighCVSS 8.7No exploitEPSS 0%
- Prototype pollution
n8n-io · n8nOct 28, 2026
CVE-2026-118678
28Monitor
n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
HighCVSS 7.1No exploitEPSS 0%
- Prototype pollution
n8n-io · n8nOct 28, 2026
CVE-2026-118683
34Monitor
MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
project-monai · monaiOct 28, 2026
CVE-2026-118684
32Monitor
MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
project-monai · monaiOct 28, 2026
CVE-2026-118686
34Monitor
EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
espocrm · espocrmOct 28, 2026
CVE-2026-118687
33Monitor
Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
coder · coderOct 28, 2026
CVE-2026-118688
35Monitor
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename
HighCVSS 8.8No exploitEPSS 0%
bytecodealliance · wasmtimeOct 28, 2026
GHSA-7w82-6f9j-v9jp
30Monitor
mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths
HighCVSS 7.5No exploit
- Pre-auth
- Path traversal
Oct 28, 2026
GHSA-4mfg-r38w-w8fg
32Monitor
mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6
HighCVSS 8.2No exploit
- Pre-auth
- SSRF
Oct 28, 2026
CVE-2025-14260
33Monitor
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
HighCVSS 8.3No exploitEPSS 0%
- SSRF
wso2 · wso2 api managerOct 28, 2026
CVE-2026-109411
32Monitor
Samba: access control bypass via vfs_ceph_rgw case-insensitive open
HighCVSS 8.1No exploitEPSS 0%
samba · sambaOct 28, 2026
CVE-2026-117574
36Monitor
Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
CriticalCVSS 9.1No exploitEPSS 0%
- Broken access control (IDOR)
red hat · red hat openshift ai (rhoai)Oct 28, 2026
CVE-2026-118650
30Monitor
Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
labstack · echoOct 28, 2026
CVE-2026-13451
30Monitor
Kserve: kserve: server-side request forgery via malicious storageuri
HighCVSS 7.7No exploitEPSS 0%
- SSRF
red hat · red hat openshift ai (rhoai)Oct 28, 2026
CVE-2026-61542
34Monitor
Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
drhelius · gearboyOct 28, 2026
CVE-2026-63190
37Monitor
FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Path traversal
- XSS
fearlessgeekmedia · fearlesscmsOct 28, 2026
CVE-2026-6647
29Monitor
Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
HighCVSS 7.4No exploitEPSS 0%
wso2 · wso2 identity serverOct 28, 2026
CVE-2026-76418
64This week
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
HighCVSS 8.6KEVWeaponizedEPSS 0%
- Pre-auth
- Denial of service
cisco · adaptive security appliance softwareOct 28, 2026
CVE-2026-78674
35Monitor
Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
wso2 · enterprise integrator (bps profile)Oct 28, 2026
CVE-2026-118659
30Monitor
@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
capricorn86 · happy-domOct 28, 2026
CVE-2026-118660
34Monitor
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SSRF
capricorn86 · happy-domOct 28, 2026
CVE-2026-118664
32Monitor
decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
samverschueren · decode-uri-componentOct 28, 2026
CVE-2026-118665
32Monitor
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
ardatan · graphql-toolsOct 28, 2026
CVE-2026-118668
34Monitor
LangGraph JavaScript custom authentication may permit cross-user Store access
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
langchain-ai · langgraph-apiOct 28, 2026
CVE-2026-116641
30Monitor
The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Weak crypto
mongodb · database toolsOct 28, 2026
CVE-2026-118669
33Monitor
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
HighCVSS 8.4Proof of conceptEPSS 0%
- Broken access control (IDOR)
oauthlib · oauthlibOct 28, 2026
CVE-2026-118682
30Monitor
ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
karingx · clashmiOct 28, 2026
CVE-2026-118689
34Monitor
OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
ovenmedialabs · ovenmediaengineOct 28, 2026
CVE-2026-118690
37Monitor
Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
signalk · signalk-serverOct 28, 2026
CVE-2026-118692
28Monitor
CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Command injection
giuspen · cherrytreeOct 28, 2026
CVE-2026-118694
34Monitor
python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
trentm · python-markdown2Oct 28, 2026
CVE-2026-118752
34Monitor
FreeImage through 3.18.0 and danoli3 fork before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
danoli3 · freeimageOct 28, 2026
CVE-2026-118753
34Monitor
FreeImage through 3.18.0 and danoli3 fork before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
danoli3 · freeimageOct 28, 2026
CVE-2026-118755
34Monitor
Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
volmarg · personal-management-systemOct 28, 2026
CVE-2026-118803
30Monitor
Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- SSTI
bricks · bricks themeOct 28, 2026
CVE-2026-118804
30Monitor
Bricks Broken Access Control via query_result Endpoint
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
bricks · bricks builderOct 28, 2026
CVE-2026-54453
28Monitor
OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)
HighCVSS 7.2No exploitEPSS 0%
- RCE
opencats · opencatsOct 28, 2026
CVE-2026-54455
30Monitor
OpenCATS: Authenticated SQL injection in activity DataGrid date filters
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
opencats · opencatsOct 28, 2026
CVE-2026-61546
35Monitor
AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
ankimcp · anki-mcp-server-addonOct 28, 2026
CVE-2026-61564
40Plan
AVideo-Encoder: unauthenticated installer PHP code injection
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
wwbn · avideo-encoderOct 28, 2026
CVE-2026-61567
40Plan
AVideo-Encoder: unauthenticated command execution through streamer login trust
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- Command injection
wwbn · avideo-encoderOct 28, 2026
CVE-2026-61569
30Monitor
AVideo-Encoder: pre-authentication streamer-login SQL injection
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
wwbn · avideo-encoderOct 28, 2026
CVE-2026-61571
29Monitor
AVideo-Encoder: missing authentication on control and status endpoints
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
wwbn · avideo-encoderOct 28, 2026
CVE-2026-61572
34Monitor
AVideo-Encoder: unauthenticated full-response server-side request forgery
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SSRF
wwbn · avideo-encoderOct 28, 2026
CVE-2026-93851
32Monitor
Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
HighCVSS 8.0No exploitEPSS 0%
- Path traversal
mattermost · mattermostOct 28, 2026
CVE-2026-118579
35Monitor
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
d-link · dir-505Oct 28, 2026
CVE-2026-85749
32Monitor
MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
- CSRF
mailwatch · mailwatchOct 28, 2026
CVE-2026-21157
33Monitor
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
HighCVSS 8.3No exploitEPSS 0%
- Local privilege escalation
samsung mobile · bixbyOct 29, 2026
CVE-2026-113387
34Monitor
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
canva · orttoOct 29, 2026
CVE-2026-66088
37Monitor
Unrestricted Command Execution via system.execute
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Command injection
apereo foundation · openequellaOct 29, 2026
CVE-2026-66090
28Monitor
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
HighCVSS 7.1No exploitEPSS 0%
- SSRF
- XXE
apereo foundation · openequellaOct 29, 2026
CVE-2026-109516
39Monitor
Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
guruteam · bot for telegram on woocommerceOct 29, 2026
CVE-2026-42922
39Monitor
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
frangoteam · frangoteamOct 29, 2026
CVE-2026-93757
30Monitor
Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
wild-apricot · wild apricot loginOct 29, 2026
CVE-2026-93855
30Monitor
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
brewlabs · sendpress newslettersOct 29, 2026
CVE-2026-93904
30Monitor
Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
dejanmarkovic · social web suite – social media auto post, social media auto publishOct 29, 2026
CVE-2026-96228
32Monitor
SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
sslplugins · ssl wireless sms notificationOct 29, 2026
CVE-2026-96666
28Monitor
Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
vberkel · schema app structured dataOct 29, 2026
CVE-2026-96669
28Monitor
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpscripts · food store – online food delivery & pickupOct 29, 2026
CVE-2026-96741
28Monitor
DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
mlfactory · dsgvo all in one for wpOct 29, 2026
CVE-2026-103693
36Monitor
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
- Deserialization
unknown · frontend dashboardOct 29, 2026
CVE-2026-111739
30Monitor
Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · two factor authenticationOct 29, 2026
CVE-2026-113616
39Monitor
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
unknown · logixfast authOct 29, 2026
CVE-2026-113617
39Monitor
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
unknown · automated import products to cartOct 29, 2026
CVE-2026-114488
29Monitor
Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
red hat · red hat fuse 7Oct 29, 2026
CVE-2026-115245
39Monitor
Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
unknown · chat ai with dispatcherOct 29, 2026
CVE-2026-115301
28Monitor
Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
HighCVSS 7.2No exploitEPSS 0%
- RCE
- SSTI
unknown · contact form by supsysticOct 29, 2026
CVE-2026-118905
28Monitor
nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Command injection
nvm-sh · nvmOct 29, 2026
CVE-2026-15564
29Monitor
Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
HighCVSS 7.4No exploitEPSS 0%
- Deserialization
red hat · red hat jboss enterprise application platform 7Oct 29, 2026
CVE-2026-86794
35Monitor
Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · community eventsOct 29, 2026
CVE-2026-89216
34Monitor
vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · vtablesOct 29, 2026