By publication date

Exploited and new serious CVEs: October 2026

8,746 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 82 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-111418No exploit	SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Servicefoxit software inc. · foxit.com · CWE-918 Pre-auth SSRF	High7.5	—	0.4%	Oct 29, 2026
34Monitor	CVE-2026-111419No exploit	Hardcoded API Token in Foxit Official Websitefoxit software inc. · foxit.com · CWE-798 Pre-auth Hard-coded credentials	High8.6	—	0.3%	Oct 29, 2026
28Monitor	CVE-2026-117611No exploit	Trust of compromised eMudhra root CA in bundled CA storescheckmk gmbh · checkmk · CWE-295 Pre-auth Weak crypto	High7.1	—	0.2%	Oct 29, 2026
36Monitor	CVE-2026-105031No exploit	Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.apache software foundation · apache qpid proton c · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.2%	Oct 29, 2026
39Monitor	CVE-2026-105042No exploit	Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crashapache software foundation · apache qpid proton c · CWE-674 Pre-auth Denial of service	Critical9.8	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-112827No exploit	WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerabilityvillatheme · handmade – dropshipping for etsy and woocommerce · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-114193No exploit	WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerabilityeyal fitoussi · geo my wordpress · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 29, 2026
39Monitor	CVE-2026-114230No exploit	Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL framesapache software foundation · apache qpid proton c · CWE-305 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-115592No exploit	WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerabilityoceanwp · oceanwp · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 29, 2026
30Monitor	CVE-2026-115599No exploit	WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerabilitythimpress · learnpress · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 29, 2026
28Monitor	CVE-2026-115611No exploit	WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilitypluginus.net · tableon · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 29, 2026
30Monitor	CVE-2026-115942No exploit	Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow readapache software foundation · apache qpid proton c · CWE-125 Pre-auth Memory safety	High7.5	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-115963No exploit	WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerabilityvideowhisper.com · broadcast live video · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 29, 2026
37Monitor	CVE-2026-115964No exploit	WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerabilitystylemixthemes · motors · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 29, 2026
34Monitor	CVE-2026-115965Proof of concept	WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerabilitybuddypress · buddypress · CWE-89 SQL injection	High8.5	—	0.2%	Oct 29, 2026
35Monitor	CVE-2026-115967No exploit	WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerabilityhamid alinia · login with phone number · CWE-1390 Auth bypass	High8.8	—	0.3%	Oct 29, 2026
28Monitor	CVE-2026-116409No exploit	WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerabilitywp swings · upsell order bump offer for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 29, 2026
28Monitor	CVE-2026-118984No exploit	OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-logincheaper-inference · omniroute · CWE-620	High7.0	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-33923No exploit	Update bundle signature bypass in Guardian/CMC before 26.4.0nozomi networks · guardian · CWE-347 Weak crypto	High7.5	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-33924No exploit	Authenticated RCE in update functionality in Guardian/CMC before 26.4.0nozomi networks · guardian · CWE-78 RCE Command injection	High7.5	—	1.1%	Oct 29, 2026
19Monitor	CVE-2026-71569Proof of concept	Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Nameapache software foundation · apache camel · CWE-918 Pre-auth SSRF	Medium4.8	—	0.3%	Oct 29, 2026
30Monitor	GHSA-fj3h-2jc3-973vNo exploit	Unbounded memory use on large request bodies Pre-auth Denial of service	High7.5	—	—	Oct 29, 2026
35Monitor	RUSTSEC-2026-0427No exploit	`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip) Pre-auth Path traversal	High8.8	—	—	Oct 29, 2026
33Monitor	CVE-2026-103665No exploit	The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs).yamaha corporation · yamaha lan monitor for windows · CWE-427 RCE Local privilege escalation	High8.4	—	0.1%	Oct 29, 2026
28Monitor	CVE-2026-109822No exploit	Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information.yamaha corporation · nwr100 · CWE-922 Pre-auth	High7.1	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-110184No exploit	Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameterblazethemes · newsmatic · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-115821No exploit	NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parametersnewsmanapp · newsmanapp · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-119025Proof of concept	open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windowssindresorhus · open · CWE-78 pre-auth RCE Command injection	High7.7	—	1.4%	Oct 29, 2026
30Monitor	CVE-2026-119027No exploit	oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extensionoapi-codegen · oapi-codegen · CWE-94 pre-auth RCE	High7.7	—	0.3%	Oct 29, 2026
34Monitor	CVE-2026-119028No exploit	oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Valuesoapi-codegen · oapi-codegen · CWE-94 pre-auth RCE	High8.7	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-96767No exploit	NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Headerwebaways · nex-forms – ultimate forms plugin for wordpress · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Oct 29, 2026
37Monitor	CVE-2026-97854No exploit	Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.yamaha corporation · nwr100 · CWE-78 pre-auth RCE Command injection	Critical9.3	—	1.3%	Oct 29, 2026
33Monitor	CVE-2026-97860No exploit	YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths.yamaha corporation · yms-vpn8 · CWE-428 RCE Local privilege escalation	High8.4	—	0.1%	Oct 29, 2026
34Monitor	CVE-2026-49142No exploit	OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]openemr · openemr · CWE-89 SQL injection	High8.7	—	0.3%	Oct 29, 2026
34Monitor	CVE-2019-25781No exploit	Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsingpython-markdown · markdown · CWE-407 Pre-auth	High8.7	—	0.4%	Oct 29, 2026
35Monitor	CVE-2026-116399No exploit	WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerabilityinstawp · instawp connect · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 29, 2026
28Monitor	CVE-2026-119049No exploit	FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claimingidinging · freemail · CWE-639 Broken access control (IDOR)	High7.2	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-119050No exploit	Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflectionagno-agi · agno · CWE-470 Pre-auth	Critical9.2	—	0.4%	Oct 29, 2026
32Monitor	CVE-2026-119051No exploit	flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keyshughsk · flat · CWE-770 Pre-auth Denial of service	High8.2	—	0.3%	Oct 29, 2026
34Monitor	CVE-2026-119052No exploit	llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Lengthggml-org · llama.cpp · CWE-248 Pre-auth	High8.7	—	0.6%	Oct 29, 2026
34Monitor	CVE-2026-39736No exploit	WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerabilitycrocoblock · jetengine · CWE-89 SQL injection	High8.5	—	0.3%	Oct 29, 2026
39Monitor	CVE-2026-79589No exploit	The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticCWE-306 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-107014No exploit	Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user'CWE-926 Pre-auth	Critical9.1	—	0.2%	Oct 29, 2026
36Monitor	CVE-2026-107015No exploit	Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note datCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-107016No exploit	Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-107017No exploit	Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily triggeCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 29, 2026
32Monitor	CVE-2026-107018No exploit	Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files insidCWE-732	High8.1	—	0.2%	Oct 29, 2026
35Monitor	CVE-2026-107019No exploit	Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to creCWE-926 Pre-auth	High8.8	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107020No exploit	An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim userCWE-601 Pre-auth Open redirect Denial of service	High7.5	—	0.5%	Oct 29, 2026
36Monitor	CVE-2026-107021No exploit	Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackerCWE-926 Pre-auth	Critical9.1	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107024No exploit	Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboardCWE-732 Pre-auth	High7.5	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-115708No exploit	Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypasselastic · elastic cloud enterprise · CWE-59 Auth bypass	High7.2	—	0.1%	Oct 29, 2026
32Monitor	CVE-2026-115709No exploit	Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Losselastic · elastic cloud enterprise · CWE-59	High8.2	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-115713No exploit	Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modificationelastic · elastic cloud enterprise · CWE-59	High7.5	—	0.1%	Oct 29, 2026
35Monitor	CVE-2026-101288No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.7%	Oct 29, 2026
30Monitor	CVE-2026-102590No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-918 SSRF	High7.7	—	0.2%	Oct 29, 2026
35Monitor	CVE-2026-103092No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-284 RCE Broken access control (IDOR)	High8.8	—	0.4%	Oct 29, 2026
39Monitor	CVE-2026-104317No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.5%	Oct 29, 2026
35Monitor	CVE-2026-104324No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-502 RCE Deserialization	High8.8	—	0.6%	Oct 29, 2026
35Monitor	CVE-2026-104328No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.7%	Oct 29, 2026
39Monitor	CVE-2026-104339No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 pre-auth RCE	Critical9.8	—	0.7%	Oct 29, 2026
30Monitor	CVE-2026-107025No exploit	Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's datCWE-926 Pre-auth	High7.5	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107026No exploit	Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clCWE-732 Pre-auth	High7.5	—	0.4%	Oct 29, 2026
36Monitor	CVE-2026-107027No exploit	Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading CWE-926 Pre-auth	Critical9.1	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-107028No exploit	Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leadinCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-107029No exploit	Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data acceCWE-732 Pre-auth	Critical9.1	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107030No exploit	Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (OCWE-926 Pre-auth	High7.5	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-107032No exploit	Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, lCWE-926 Pre-auth	Critical9.1	—	0.4%	Oct 29, 2026
36Monitor	CVE-2026-107034No exploit	Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note datCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107037No exploit	Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in anoCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Oct 29, 2026
36Monitor	CVE-2026-107038No exploit	Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leadingCWE-926 Pre-auth	Critical9.1	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107039No exploit	Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.33CWE-732 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
36Monitor	CVE-2026-107040No exploit	Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitraCWE-926 Pre-auth	Critical9.1	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107041No exploit	Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarCWE-926 Pre-auth Denial of service	High7.5	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-107042No exploit	Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in aCWE-732 Pre-auth	High7.5	—	0.3%	Oct 29, 2026
35Monitor	CVE-2026-107326Proof of concept	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-78 RCE Command injection	High8.8	—	0.7%	Oct 29, 2026
35Monitor	CVE-2026-107327Proof of concept	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-862 RCE Broken access control (IDOR)	High8.8	—	0.6%	Oct 29, 2026
35Monitor	CVE-2026-107328Proof of concept	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.8%	Oct 29, 2026
35Monitor	CVE-2026-107329Proof of concept	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.8%	Oct 29, 2026
28Monitor	CVE-2026-108494No exploit	WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilitybob · chained quiz · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 29, 2026
39Monitor	CVE-2026-110186Proof of concept	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 pre-auth RCE	Critical9.8	—	0.6%	Oct 29, 2026
35Monitor	CVE-2026-110193No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.7%	Oct 29, 2026
35Monitor	CVE-2026-110196No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-862 RCE Broken access control (IDOR)	High8.8	—	0.4%	Oct 29, 2026
26Monitor	CVE-2026-110200Proof of concept	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-312	Medium6.5	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-110245No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-287 Pre-auth Auth bypass	High7.5	—	0.3%	Oct 29, 2026
35Monitor	CVE-2026-110309No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.5%	Oct 29, 2026
28Monitor	CVE-2026-111730No exploit	Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name lengthrt-labs · p-net · CWE-787 pre-auth RCE Memory safety	High7.2	—	0.1%	Oct 29, 2026
34Monitor	CVE-2026-111731No exploit	Infinite loop when reading PDPortDataCheck record of subslot 0rt-labs · p-net · CWE-835 Pre-auth Denial of service	High8.7	—	0.4%	Oct 29, 2026
37Monitor	CVE-2026-111732No exploit	Out-of-bounds write when parsing AR Vendor Block requestsrt-labs · p-net · CWE-787 pre-auth RCE Memory safety	Critical9.3	—	0.4%	Oct 29, 2026
34Monitor	CVE-2026-111733No exploit	NULL pointer dereference on implicit read of AR specific record indexrt-labs · p-net · CWE-476 Pre-auth Memory safety	High8.7	—	0.3%	Oct 29, 2026
28Monitor	CVE-2026-111734No exploit	Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()rt-labs · p-net · CWE-125 Pre-auth Memory safety	High7.1	—	0.1%	Oct 29, 2026
28Monitor	CVE-2026-111735No exploit	Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()rt-labs · p-net · CWE-125 Pre-auth Memory safety	High7.1	—	0.1%	Oct 29, 2026
34Monitor	CVE-2026-111736No exploit	NULL pointer dereference on implicit read of user specific record indexrt-labs · p-net · CWE-476 Pre-auth Memory safety	High8.7	—	0.3%	Oct 29, 2026
34Monitor	CVE-2026-112200No exploit	Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endiannessrt-labs · p-net · CWE-772 Pre-auth	High8.7	—	0.4%	Oct 29, 2026
36Monitor	CVE-2026-112256No exploit	Logon bypass (trust of attacker-controlled completed-methods list)opentext · advanced authentication server · CWE-349 Pre-auth	Critical9.2	—	0.2%	Oct 29, 2026
31Monitor	CVE-2026-114148Proof of concept	ASP.NET Core Elevation of Privilege Vulnerabilitymicrosoft · .net 10.0 installed on linux · CWE-276 Local privilege escalation	High7.8	—	0.3%	Oct 29, 2026
34Monitor	CVE-2026-115793No exploit	Resource exhaustion from RPC sessions kept for requests to unknown interfacert-labs · p-net · CWE-772 Pre-auth	High8.7	—	0.3%	Oct 29, 2026
28Monitor	CVE-2026-116864No exploit	WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerabilityarni cinco · wpcargo track & trace · CWE-502 Deserialization	High7.2	—	0.3%	Oct 29, 2026
28Monitor	CVE-2026-116865No exploit	WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerabilitygesundheit bewegt gmbh · zippy · CWE-502 Deserialization	High7.2	—	0.3%	Oct 29, 2026
35Monitor	CVE-2026-116866No exploit	WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerabilitydotstore · extra fees plugin for woocommerce · CWE-502 Deserialization	High8.8	—	0.2%	Oct 29, 2026

CVE-2026-111418
30Monitor
SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
foxit software inc. · foxit.comOct 29, 2026
CVE-2026-111419
34Monitor
Hardcoded API Token in Foxit Official Website
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
foxit software inc. · foxit.comOct 29, 2026
CVE-2026-117611
28Monitor
Trust of compromised eMudhra root CA in bundled CA stores
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
checkmk gmbh · checkmkOct 29, 2026
CVE-2026-105031
36Monitor
Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
apache software foundation · apache qpid proton cOct 29, 2026
CVE-2026-105042
39Monitor
Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache qpid proton cOct 29, 2026
CVE-2026-112827
28Monitor
WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
villatheme · handmade – dropshipping for etsy and woocommerceOct 29, 2026
CVE-2026-114193
30Monitor
WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
eyal fitoussi · geo my wordpressOct 29, 2026
CVE-2026-114230
39Monitor
Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache qpid proton cOct 29, 2026
CVE-2026-115592
28Monitor
WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
oceanwp · oceanwpOct 29, 2026
CVE-2026-115599
30Monitor
WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
thimpress · learnpressOct 29, 2026
CVE-2026-115611
28Monitor
WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
pluginus.net · tableonOct 29, 2026
CVE-2026-115942
30Monitor
Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
apache software foundation · apache qpid proton cOct 29, 2026
CVE-2026-115963
28Monitor
WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
videowhisper.com · broadcast live videoOct 29, 2026
CVE-2026-115964
37Monitor
WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
stylemixthemes · motorsOct 29, 2026
CVE-2026-115965
34Monitor
WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
HighCVSS 8.5Proof of conceptEPSS 0%
- SQL injection
buddypress · buddypressOct 29, 2026
CVE-2026-115967
35Monitor
WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
hamid alinia · login with phone numberOct 29, 2026
CVE-2026-116409
28Monitor
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp swings · upsell order bump offer for woocommerceOct 29, 2026
CVE-2026-118984
28Monitor
OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
HighCVSS 7.0No exploitEPSS 0%
cheaper-inference · omnirouteOct 29, 2026
CVE-2026-33923
30Monitor
Update bundle signature bypass in Guardian/CMC before 26.4.0
HighCVSS 7.5No exploitEPSS 0%
- Weak crypto
nozomi networks · guardianOct 29, 2026
CVE-2026-33924
30Monitor
Authenticated RCE in update functionality in Guardian/CMC before 26.4.0
HighCVSS 7.5No exploitEPSS 1%
- RCE
- Command injection
nozomi networks · guardianOct 29, 2026
CVE-2026-71569
19Monitor
Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
MediumCVSS 4.8Proof of conceptEPSS 0%
- Pre-auth
- SSRF
apache software foundation · apache camelOct 29, 2026
GHSA-fj3h-2jc3-973v
30Monitor
Unbounded memory use on large request bodies
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 29, 2026
RUSTSEC-2026-0427
35Monitor
`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)
HighCVSS 8.8No exploit
- Pre-auth
- Path traversal
Oct 29, 2026
CVE-2026-103665
33Monitor
The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs).
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Local privilege escalation
yamaha corporation · yamaha lan monitor for windowsOct 29, 2026
CVE-2026-109822
28Monitor
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information.
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
yamaha corporation · nwr100Oct 29, 2026
CVE-2026-110184
30Monitor
Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
blazethemes · newsmaticOct 29, 2026
CVE-2026-115821
28Monitor
NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
newsmanapp · newsmanappOct 29, 2026
CVE-2026-119025
30Monitor
open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
HighCVSS 7.7Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
sindresorhus · openOct 29, 2026
CVE-2026-119027
30Monitor
oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
oapi-codegen · oapi-codegenOct 29, 2026
CVE-2026-119028
34Monitor
oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
oapi-codegen · oapi-codegenOct 29, 2026
CVE-2026-96767
28Monitor
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
webaways · nex-forms – ultimate forms plugin for wordpressOct 29, 2026
CVE-2026-97854
37Monitor
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability.
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
yamaha corporation · nwr100Oct 29, 2026
CVE-2026-97860
33Monitor
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths.
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Local privilege escalation
yamaha corporation · yms-vpn8Oct 29, 2026
CVE-2026-49142
34Monitor
OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
openemr · openemrOct 29, 2026
CVE-2019-25781
34Monitor
Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
python-markdown · markdownOct 29, 2026
CVE-2026-116399
35Monitor
WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
instawp · instawp connectOct 29, 2026
CVE-2026-119049
28Monitor
FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
idinging · freemailOct 29, 2026
CVE-2026-119050
36Monitor
Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
agno-agi · agnoOct 29, 2026
CVE-2026-119051
32Monitor
flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
hughsk · flatOct 29, 2026
CVE-2026-119052
34Monitor
llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
ggml-org · llama.cppOct 29, 2026
CVE-2026-39736
34Monitor
WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
crocoblock · jetengineOct 29, 2026
CVE-2026-79589
39Monitor
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthentic
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
Oct 29, 2026
CVE-2026-107014
36Monitor
Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user'
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107015
36Monitor
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note dat
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-107016
30Monitor
Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-107017
36Monitor
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigge
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-107018
32Monitor
Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files insid
HighCVSS 8.1No exploitEPSS 0%
Oct 29, 2026
CVE-2026-107019
35Monitor
Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to cre
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107020
30Monitor
An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim user
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Open redirect
- Denial of service
Oct 29, 2026
CVE-2026-107021
36Monitor
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attacker
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107024
30Monitor
Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-115708
28Monitor
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass
HighCVSS 7.2No exploitEPSS 0%
- Auth bypass
elastic · elastic cloud enterpriseOct 29, 2026
CVE-2026-115709
32Monitor
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss
HighCVSS 8.2No exploitEPSS 0%
elastic · elastic cloud enterpriseOct 29, 2026
CVE-2026-115713
30Monitor
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification
HighCVSS 7.5No exploitEPSS 0%
elastic · elastic cloud enterpriseOct 29, 2026
CVE-2026-101288
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 29, 2026
CVE-2026-102590
30Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 7.7No exploitEPSS 0%
- SSRF
langflow · langflowOct 29, 2026
CVE-2026-103092
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
langflow · langflowOct 29, 2026
CVE-2026-104317
39Monitor
Langflow OSS is affected by multiple vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
langflow · langflowOct 29, 2026
CVE-2026-104324
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
langflow · langflowOct 29, 2026
CVE-2026-104328
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 29, 2026
CVE-2026-104339
39Monitor
Langflow OSS is affected by multiple vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
langflow · langflowOct 29, 2026
CVE-2026-107025
30Monitor
Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's dat
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107026
30Monitor
Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's cl
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107027
36Monitor
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107028
36Monitor
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leadin
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-107029
36Monitor
Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data acce
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107030
30Monitor
Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (O
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107032
36Monitor
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107034
36Monitor
Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note dat
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-107037
30Monitor
Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in ano
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-107038
36Monitor
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107039
30Monitor
Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.33
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 29, 2026
CVE-2026-107040
36Monitor
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitra
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107041
30Monitor
Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrar
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 29, 2026
CVE-2026-107042
30Monitor
Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in a
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107326
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- Command injection
langflow · langflowOct 29, 2026
CVE-2026-107327
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- Broken access control (IDOR)
langflow · langflowOct 29, 2026
CVE-2026-107328
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
langflow · langflowOct 29, 2026
CVE-2026-107329
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
langflow · langflowOct 29, 2026
CVE-2026-108494
28Monitor
WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bob · chained quizOct 29, 2026
CVE-2026-110186
39Monitor
Langflow OSS is affected by multiple vulnerabilities
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
langflow · langflowOct 29, 2026
CVE-2026-110193
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 29, 2026
CVE-2026-110196
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
langflow · langflowOct 29, 2026
CVE-2026-110200
26Monitor
Langflow OSS is affected by multiple vulnerabilities
MediumCVSS 6.5Proof of conceptEPSS 0%
langflow · langflowOct 29, 2026
CVE-2026-110245
30Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
langflow · langflowOct 29, 2026
CVE-2026-110309
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 29, 2026
CVE-2026-111730
28Monitor
Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
HighCVSS 7.2No exploitEPSS 0%
- pre-auth RCE
- Memory safety
rt-labs · p-netOct 29, 2026
CVE-2026-111731
34Monitor
Infinite loop when reading PDPortDataCheck record of subslot 0
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
rt-labs · p-netOct 29, 2026
CVE-2026-111732
37Monitor
Out-of-bounds write when parsing AR Vendor Block requests
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
rt-labs · p-netOct 29, 2026
CVE-2026-111733
34Monitor
NULL pointer dereference on implicit read of AR specific record index
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
rt-labs · p-netOct 29, 2026
CVE-2026-111734
28Monitor
Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
rt-labs · p-netOct 29, 2026
CVE-2026-111735
28Monitor
Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
rt-labs · p-netOct 29, 2026
CVE-2026-111736
34Monitor
NULL pointer dereference on implicit read of user specific record index
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
rt-labs · p-netOct 29, 2026
CVE-2026-112200
34Monitor
Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
rt-labs · p-netOct 29, 2026
CVE-2026-112256
36Monitor
Logon bypass (trust of attacker-controlled completed-methods list)
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
opentext · advanced authentication serverOct 29, 2026
CVE-2026-114148
31Monitor
ASP.NET Core Elevation of Privilege Vulnerability
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
microsoft · .net 10.0 installed on linuxOct 29, 2026
CVE-2026-115793
34Monitor
Resource exhaustion from RPC sessions kept for requests to unknown interface
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
rt-labs · p-netOct 29, 2026
CVE-2026-116864
28Monitor
WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
arni cinco · wpcargo track & traceOct 29, 2026
CVE-2026-116865
28Monitor
WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
gesundheit bewegt gmbh · zippyOct 29, 2026
CVE-2026-116866
35Monitor
WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
dotstore · extra fees plugin for woocommerceOct 29, 2026