Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2026

8,744 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 83 of 88

  • CVE-2026-118075
    35Monitor

    WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    dbarrere · wp media foldersOct 29, 2026

  • CVE-2026-118076
    35Monitor

    WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    frisbii · frisbii payOct 29, 2026

  • CVE-2026-118077
    28Monitor

    WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    fast themes · sastra essential addons for elementorOct 29, 2026

  • CVE-2026-118078
    28Monitor

    WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    pixelyoursite · product catalog feed by pixelyoursiteOct 29, 2026

  • CVE-2026-118079
    28Monitor

    WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    foliovision · fv flowplayer video playerOct 29, 2026

  • CVE-2026-118080
    35Monitor

    WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    social snap · social snapOct 29, 2026

  • CVE-2026-118081
    35Monitor

    WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    10web · 10web social photo feedOct 29, 2026

  • CVE-2026-118082
    35Monitor

    WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    buddyboss · buddyboss platformOct 29, 2026

  • CVE-2026-118083
    30Monitor

    WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    themeum · wp crowdfundingOct 29, 2026

  • CVE-2026-118085
    28Monitor

    WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    global payments · globalpayments woocommerceOct 29, 2026

  • CVE-2026-119118
    33Monitor

    Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags

    HighCVSS 8.3No exploitEPSS 0%

    unclecode · crawl4aiOct 29, 2026

  • CVE-2026-119119
    34Monitor

    Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

    HighCVSS 8.7No exploitEPSS 0%

    unclecode · crawl4aiOct 29, 2026

  • CVE-2026-119120
    30Monitor

    Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name

    HighCVSS 7.7No exploitEPSS 0%

    unclecode · crawl4aiOct 29, 2026

  • CVE-2026-119127
    34Monitor

    ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection

    HighCVSS 8.6No exploitEPSS 0%

    zitadel · zitadelOct 29, 2026

  • CVE-2026-119128
    36Monitor

    ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

    CriticalCVSS 9.1No exploitEPSS 0%

    zitadel · zitadelOct 29, 2026

  • CVE-2026-119129
    34Monitor

    ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

    HighCVSS 8.6No exploitEPSS 0%

    zitadel · zitadelOct 29, 2026

  • CVE-2026-119144
    34Monitor

    Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields

    HighCVSS 8.7No exploitEPSS 0%

    frappe · frappeOct 29, 2026

  • CVE-2026-119145
    37Monitor

    Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

    CriticalCVSS 9.4No exploitEPSS 0%

    frappe · frappeOct 29, 2026

  • CVE-2026-18894
    39Monitor

    Langflow OSS is affected by multiple vulnerabilities

    CriticalCVSS 9.8No exploitEPSS 0%

    langflow · langflowOct 29, 2026

  • CVE-2026-27394
    28Monitor

    WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    jyothis joy · eventerOct 29, 2026

  • CVE-2026-42692
    28Monitor

    WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    themeum · wp crowdfundingOct 29, 2026

  • CVE-2026-42701
    28Monitor

    WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    yaycommerce · yaymailOct 29, 2026

  • CVE-2026-54856
    39Monitor

    WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · rexcoinOct 29, 2026

  • CVE-2026-54857
    39Monitor

    WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · quirkyOct 29, 2026

  • CVE-2026-54858
    39Monitor

    WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · printyOct 29, 2026

  • CVE-2026-54859
    39Monitor

    WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · preservationOct 29, 2026

  • CVE-2026-54860
    39Monitor

    WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · ozistiOct 29, 2026

  • CVE-2026-54864
    28Monitor

    WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    nicashmu · post video playersOct 29, 2026

  • CVE-2026-54866
    28Monitor

    WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    razorpay · razorpay payment button elementor pluginOct 29, 2026

  • CVE-2026-61988
    28Monitor

    WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    morehawes · auction nudge – your ebay on your siteOct 29, 2026

  • CVE-2026-61989
    28Monitor

    WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    merv barrett · easy property listingsOct 29, 2026

  • CVE-2026-61991
    40Plan

    WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 10.0No exploitEPSS 0%

    ajax load more · ajaxloadmore cacheOct 29, 2026

  • CVE-2026-61992
    39Monitor

    WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    von eyal fitoussi · geo my wordpressOct 29, 2026

  • CVE-2026-61993
    28Monitor

    WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    blockonomics · blockonomicsOct 29, 2026

  • CVE-2026-61995
    28Monitor

    WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    emarket-design · youtube showcaseOct 29, 2026

  • CVE-2026-61996
    34Monitor

    WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

    HighCVSS 8.5No exploitEPSS 0%

    favethemes · mls on the flyOct 29, 2026

  • CVE-2026-61997
    39Monitor

    WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · legal stoneOct 29, 2026

  • CVE-2026-61998
    39Monitor

    WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · le truffeOct 29, 2026

  • CVE-2026-62001
    39Monitor

    WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · marcellOct 29, 2026

  • CVE-2026-62002
    39Monitor

    WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · meals & wheelsOct 29, 2026

  • CVE-2026-62003
    39Monitor

    WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · missionOct 29, 2026

  • CVE-2026-62004
    39Monitor

    WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · motorixOct 29, 2026

  • CVE-2026-62005
    39Monitor

    WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · muziconOct 29, 2026

  • CVE-2026-62006
    39Monitor

    WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · nutsOct 29, 2026

  • CVE-2026-62008
    39Monitor

    WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · orpheusOct 29, 2026

  • CVE-2026-62009
    39Monitor

    WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · filmaxOct 29, 2026

  • CVE-2026-62010
    39Monitor

    WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · avventureOct 29, 2026

  • CVE-2026-62011
    39Monitor

    WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · bonbonOct 29, 2026

  • CVE-2026-62012
    39Monitor

    WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · coinpressOct 29, 2026

  • CVE-2026-62013
    39Monitor

    WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · edge decorOct 29, 2026

  • CVE-2026-62014
    39Monitor

    WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · emojinationOct 29, 2026

  • CVE-2026-62015
    39Monitor

    WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · gamezoneOct 29, 2026

  • CVE-2026-62016
    39Monitor

    WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · gamicOct 29, 2026

  • CVE-2026-62017
    39Monitor

    WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · good homesOct 29, 2026

  • CVE-2026-62018
    39Monitor

    WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    themerex · gunslingerOct 29, 2026

  • CVE-2026-62131
    39Monitor

    WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    zoho flow · zoho flowOct 29, 2026

  • CVE-2026-84294
    30Monitor

    Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

    HighCVSS 7.7No exploitEPSS 0%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-84295
    40Plan

    Improper Authentication in Progress WS_FTP Server

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-85890
    35Monitor

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-85897
    35Monitor

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-85899
    32Monitor

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-88077
    35Monitor

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-90863
    36Monitor

    Privilege Escalation via Missing Authorization in WS_FTP Manager

    CriticalCVSS 9.1No exploitEPSS 0%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-90864
    36Monitor

    Host Administrator Path Containment Bypass in Progress WS_FTP Server

    CriticalCVSS 9.1No exploitEPSS 0%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-90865
    36Monitor

    Command Injection via FTP Notification Variables in Progress WS_FTP Server

    CriticalCVSS 9.0No exploitEPSS 1%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-90866
    36Monitor

    Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

    CriticalCVSS 9.1No exploitEPSS 0%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-90867
    32Monitor

    Improper Access Control of Web Admin Console in Progress WS_FTP Server

    HighCVSS 8.1No exploitEPSS 0%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-90868
    39Monitor

    OS Command Injection in Progress WS_FTP Server

    CriticalCVSS 9.9No exploitEPSS 1%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-90869
    30Monitor

    Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

    HighCVSS 7.5No exploitEPSS 0%

    progress software · ws_ftp serverOct 29, 2026

  • CVE-2026-93570
    32Monitor

    XML External Entity injection in Szafir and Szafir Weryfikująca

    HighCVSS 8.2No exploitEPSS 0%

    krajowa izba rozliczeniowa · szafirOct 29, 2026

  • CVE-2026-93680
    60This week

    Langflow OSS is affected by multiple vulnerabilities

    CriticalCVSS 9.8WeaponizedEPSS 2%

    langflow · langflowOct 29, 2026

  • CVE-2026-96187
    29Monitor

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    HighCVSS 7.4No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-96192
    35Monitor

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edgeOct 29, 2026

  • CVE-2026-96196
    35Monitor

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-96198
    35Monitor

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-96199
    35Monitor

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • CVE-2026-96203
    35Monitor

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumOct 29, 2026

  • GHSA-w9x9-j56r-h98r
    32Monitor

    @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

    HighCVSS 8.2No exploit

    Oct 29, 2026

  • GHSA-vpp8-g58w-m8mp
    30Monitor

    Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

    HighCVSS 7.5No exploit

    Oct 29, 2026

  • CVE-2023-7357
    34Monitor

    FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability

    HighCVSS 8.6No exploitEPSS 0%

    revera · flexnet publisherOct 29, 2026

  • CVE-2026-107043
    36Monitor

    Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mecha

    CriticalCVSS 9.1No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107044
    30Monitor

    Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAX

    HighCVSS 7.5No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107045
    36Monitor

    Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily

    CriticalCVSS 9.1No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107047
    30Monitor

    Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanis

    HighCVSS 7.5No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107048
    39Monitor

    An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107049
    30Monitor

    An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI st

    HighCVSS 7.5No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107050
    39Monitor

    An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to a

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107051
    30Monitor

    Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate

    HighCVSS 7.5No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107052
    30Monitor

    Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily r

    HighCVSS 7.5No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107053
    36Monitor

    Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in

    CriticalCVSS 9.1No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107055
    30Monitor

    Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary file

    HighCVSS 7.5No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107056
    36Monitor

    Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject

    CriticalCVSS 9.1No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107057
    39Monitor

    An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107058
    39Monitor

    An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107059
    30Monitor

    An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker cont

    HighCVSS 7.5No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-107060
    36Monitor

    Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN config

    CriticalCVSS 9.1No exploitEPSS 0%

    Oct 29, 2026

  • CVE-2026-115805
    31Monitor

    Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path

    HighCVSS 7.8No exploitEPSS 0%

    rapid7 · insight agentOct 29, 2026

  • CVE-2026-118758
    30Monitor

    Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source

    HighCVSS 7.5No exploitEPSS 0%

    kubeflow · pipelinesOct 29, 2026

  • CVE-2026-118759
    30Monitor

    Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant

    HighCVSS 7.5No exploitEPSS 0%

    kubeflow · pipelinesOct 29, 2026

  • CVE-2026-118761
    30Monitor

    Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

    HighCVSS 7.5No exploitEPSS 0%

    kubeflow · pipelinesOct 29, 2026