By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 84 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-107056No exploit	Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to injectCWE-732 Pre-auth	Critical9.1	—	0.2%	Oct 29, 2026
39Monitor	CVE-2026-107057No exploit	An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.CWE-926 pre-auth RCE	Critical9.8	—	0.3%	Oct 29, 2026
39Monitor	CVE-2026-107058No exploit	An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-107059No exploit	An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker contCWE-926 Pre-auth Auth bypass	High7.5	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-107060No exploit	Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configCWE-732 Pre-auth	Critical9.1	—	0.2%	Oct 29, 2026
31Monitor	CVE-2026-115805No exploit	Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Pathrapid7 · insight agent · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.1%	Oct 29, 2026
30Monitor	CVE-2026-118758No exploit	Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact sourcekubeflow · pipelines · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Oct 29, 2026
30Monitor	CVE-2026-118759No exploit	Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenantkubeflow · pipelines · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-118761No exploit	Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memorykubeflow · pipelines · CWE-409 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
37Monitor	CVE-2026-118762No exploit	Monkeytype: fork PR can execute code with elevated GITHUB_TOKENmonkeytypegame · monkeytype · CWE-829 pre-auth RCE	Critical9.3	—	0.3%	Oct 29, 2026
29Monitor	CVE-2026-118763No exploit	@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Locationsigstore · sigstore-js · CWE-522 Pre-auth Info leak	High7.4	—	0.3%	Oct 29, 2026
29Monitor	CVE-2026-118765No exploit	Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing staterandombit · botan · CWE-335	High7.3	—	0.1%	Oct 29, 2026
33Monitor	CVE-2026-119115No exploit	Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetesaws · aws-privateca-issuer · CWE-863 Broken access control (IDOR)	High8.4	—	0.1%	Oct 29, 2026
28Monitor	CVE-2026-11587No exploit	Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0centreon · centreon · CWE-89 SQL injection	High7.2	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-62374No exploit	SD JWT JS: Tampered disclosures silently dropped instead of rejectedopenwallet-foundation · @sd-jwt/core · CWE-176	High7.1	—	0.2%	Oct 29, 2026
33Monitor	CVE-2026-107347No exploit	Nomad dispatch payload writes can escape the allocation directory through symlinkshashicorp · nomad · CWE-59	High8.4	—	0.1%	Oct 29, 2026
36Monitor	CVE-2026-118769No exploit	Botan: Integer overflow when reporting block size in FFI can cause memory corruptionrandombit · botan · CWE-125 Pre-auth Memory safety	Critical9.2	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-51851No exploit	modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_fCWE-22 Pre-auth Path traversal	High7.5	—	0.6%	Oct 29, 2026
36Monitor	CVE-2026-51863No exploit	DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:12CWE-22 Pre-auth Path traversal	Critical9.1	—	0.8%	Oct 29, 2026
32Monitor	CVE-2026-51903No exploit	SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.CWE-284 Broken access control (IDOR)	High8.1	—	0.3%	Oct 29, 2026
35Monitor	CVE-2026-51905No exploit	TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/aCWE-284 Broken access control (IDOR)	High8.8	—	0.3%	Oct 29, 2026
39Monitor	CVE-2026-51912No exploit	OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reachesCWE-22 Pre-auth Path traversal	Critical9.8	—	0.7%	Oct 29, 2026
37Monitor	CVE-2026-103093No exploit	Sandbox Escape via Table Rotation in ServiceNow AI Platformservicenow · servicenow ai platform · CWE-284 RCE Broken access control (IDOR)	Critical9.4	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-103094No exploit	Cleartext Storage of OAuth Credentials in ServiceNow AI Platformservicenow · servicenow ai platform · CWE-256	High7.1	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-118772No exploit	joi: quadratic-time split in `string().email({ multiple: true })` allows denial of servicehapijs · joi · CWE-1333 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
21Monitor	CVE-2026-118776Proof of concept	Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryptiondigitalbazaar · forge · CWE-20 Pre-auth	Medium5.3	—	0.1%	Oct 29, 2026
30Monitor	CVE-2026-118779No exploit	Forge: Regular expression denial of service in PEM decoding (pem.decode)digitalbazaar · forge · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 29, 2026
30Monitor	CVE-2026-118782No exploit	Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countdigitalbazaar · forge · CWE-354 Pre-auth	High7.5	—	0.1%	Oct 29, 2026
35Monitor	CVE-2026-119168No exploit	Nomad allocation data migration may allow host directory permission modification via symlink followinghashicorp · nomad · CWE-59 Local privilege escalation	High8.8	—	0.1%	Oct 29, 2026
30Monitor	CVE-2026-119249No exploit	A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop toubiquiti inc · wifiman desktop for macos · CWE-1327 Pre-auth	High7.5	—	0.3%	Oct 29, 2026
31Monitor	CVE-2026-119250No exploit	A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFimanubiquiti inc · wifiman desktop for macos · CWE-73 RCE Path traversal Local privilege escalation	High7.8	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-41216No exploit	An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6.vtk · vtk · CWE-825 Pre-auth Denial of service	High7.5	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-42057No exploit	An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6.vtk · vtk · CWE-825 Pre-auth Denial of service	High7.5	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-8822No exploit	A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1).vtk · vtk · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-8824No exploit	A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1).vtk · vtk · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 29, 2026
32Monitor	CVE-2026-9535No exploit	A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1).vtk · vtk · CWE-125 Pre-auth Memory safety	High8.2	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-9536No exploit	A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1).vtk · vtk · CWE-122 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-119187No exploit	Forge: Denial of service in TLS record processing via call stack exhaustiondigitalbazaar · forge · CWE-674 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-119188No exploit	Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messagedigitalbazaar · forge · CWE-248 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
29Monitor	CVE-2026-119190No exploit	Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13digitalbazaar · forge · CWE-295 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-119191No exploit	Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDerdigitalbazaar · forge · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-119194No exploit	pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decodingpyasn1 · pyasn1 · CWE-407 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-119195No exploit	pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decodingpyasn1 · pyasn1 · CWE-407 Pre-auth Denial of service	High7.5	—	0.5%	Oct 29, 2026
30Monitor	CVE-2026-119196No exploit	pyasn1: Quadratic CPU consumption in constructed BIT STRING decodingpyasn1 · pyasn1 · CWE-407 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
30Monitor	CVE-2026-119197No exploit	pyasn1: Quadratic-complexity denial of service in binary REAL decodingpyasn1 · pyasn1 · CWE-407 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
31Monitor	CVE-2026-51831No exploit	An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to exCWE-94 RCE	High7.8	—	0.1%	Oct 29, 2026
31Monitor	CVE-2026-51832No exploit	An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to exCWE-94 RCE	High7.8	—	0.1%	Oct 29, 2026
29Monitor	CVE-2026-92092No exploit	Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verificationred hat · red hat openshift container platform 4 · CWE-494 pre-auth RCE	High7.4	—	0.2%	Oct 29, 2026
26Monitor	CVE-2026-119200Proof of concept	Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesnuxt · nuxt · CWE-41 Pre-auth	Medium6.5	—	0.3%	Oct 29, 2026
30Monitor	CVE-2026-119202No exploit	@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of servicehapijs · content · CWE-1333 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
28Monitor	CVE-2026-119203No exploit	pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer searchpy-pdf · pypdf · CWE-835 Pre-auth Denial of service	High7.1	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-119204No exploit	pypdf: Possible large memory usage when parsing page treepy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High7.1	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-119205No exploit	pypdf: Possible infinite loop when cloning dictionariespy-pdf · pypdf · CWE-835 Pre-auth Denial of service	High7.1	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-119206No exploit	pypdf: Possible long runtimes when retrieving page labelspy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High7.1	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-119207No exploit	pypdf: Possible large memory usage for exceptions in strict modepy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High7.1	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-119208No exploit	pypdf: Possible long runtimes/large memory usage for encrypted PDF filespy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High7.1	—	0.2%	Oct 29, 2026
28Monitor	CVE-2026-119209No exploit	pypdf: Possible large memory usage when parsing cross-reference streamspy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High7.1	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-119325No exploit	Bricks Theme Broken Access Control via load_popup_contentbricks · bricks theme · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 29, 2026
34Monitor	CVE-2026-13303No exploit	Boundary vulnerable to server-side request forgery in Vault credential storehashicorp · boundary · CWE-918 SSRF	High8.7	—	0.2%	Oct 29, 2026
33Monitor	CVE-2026-61576No exploit	Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API keylightdash · lightdash · CWE-22 Pre-auth Path traversal	High8.3	—	0.4%	Oct 29, 2026
39Monitor	CVE-2026-115943No exploit	Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmtCWE-95 pre-auth RCE	Critical9.8	—	0.6%	Oct 29, 2026
29Monitor	CVE-2026-119282No exploit	Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradlenrwl · nx · CWE-78 RCE Local privilege escalation Command injection	High7.3	—	0.1%	Oct 29, 2026
30Monitor	CVE-2026-119283No exploit	joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryptionauthlib · joserfc · CWE-400 Pre-auth Denial of service	High7.5	—	0.2%	Oct 29, 2026
30Monitor	CVE-2026-119286No exploit	GraphQL-core: Denial of service via memory leak in aborted validationsgraphql-python · graphql-core · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 29, 2026
33Monitor	CVE-2026-45049No exploit	OpenAM Session Hijacking via CDSSOopenidentityplatform · openam · CWE-201 Pre-auth	High8.3	—	0.3%	Oct 29, 2026
36Monitor	CVE-2026-61645No exploit	Docat has Arbitrary File Upload exists in Upload APIdocat-org · docat · CWE-434 RCE Path traversal File upload	Critical9.1	—	0.4%	Oct 29, 2026
33Monitor	CVE-2026-61654No exploit	Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API keylightdash · lightdash · CWE-89 Pre-auth SQL injection Path traversal	High8.3	—	0.3%	Oct 29, 2026
32Monitor	CVE-2026-61671No exploit	WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classeslabredescefetrj · wegia · CWE-352 Broken access control (IDOR) CSRF	High8.1	—	0.1%	Oct 29, 2026
36Monitor	CVE-2026-61707No exploit	SOCFortress CoPilot: Stored case-report template injection permits backend code executionsocfortress · copilot · CWE-94 RCE SSTI	Critical9.0	—	0.2%	Oct 29, 2026
35Monitor	CVE-2026-61719No exploit	WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Fieldlabredescefetrj · wegia · CWE-79 XSS	High8.9	—	0.2%	Oct 29, 2026
37Monitor	CVE-2023-22793No exploit	A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Exteveeam · management pack for microsoft system center · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	0.5%	Oct 29, 2026
34Monitor	CVE-2026-107238No exploit	A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running tveeam · management pack for microsoft system center · CWE-502 RCE Deserialization	High8.7	—	0.4%	Oct 29, 2026
35Monitor	CVE-2026-107239No exploit	A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers runniveeam · management pack for microsoft system center · CWE-23 RCE Path traversal	High8.8	—	0.6%	Oct 29, 2026
34Monitor	CVE-2026-92744Proof of concept	Delinea Privilege Manager agent unauthenticated remote code execution vulnerabilitydelinea · privilege manager · CWE-295 RCE Weak crypto	High8.7	—	0.2%	Oct 29, 2026
35Monitor	CVE-2026-119260No exploit	Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 30, 2026
38Monitor	CVE-2026-119261No exploit	Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentgoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-119262No exploit	Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 30, 2026
38Monitor	CVE-2026-119263No exploit	Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119264No exploit	Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119265No exploit	Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pgoogle · chrome · CWE-706 pre-auth RCE	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119266No exploit	Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pgoogle · chrome · CWE-706 pre-auth RCE	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119267No exploit	Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119268No exploit	Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119269No exploit	Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a craftedgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119270No exploit	Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the rengoogle · chrome · CWE-706 Pre-auth	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-119271No exploit	Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-908 Pre-auth Memory safety	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-76025No exploit	Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to exegoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-76026No exploit	Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafgoogle · chrome · CWE-346 Pre-auth	High8.8	—	0.1%	Oct 30, 2026
35Monitor	CVE-2026-76028No exploit	Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to exegoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-76029No exploit	Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the google · chrome · CWE-20 pre-auth RCE	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-76030No exploit	Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potgoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-76031No exploit	Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass wgoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-15466No exploit	GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()imagination technologies · graphics ddk · CWE-416 Local privilege escalation Memory safety Race condition	High7.0	—	0.1%	Oct 30, 2026
30Monitor	CVE-2026-18629No exploit	GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilationimagination technologies · graphics ddk · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-19199No exploit	GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSetimagination technologies · graphics ddk · CWE-190 Local privilege escalation Memory safety	High7.1	—	0.1%	Oct 30, 2026
31Monitor	CVE-2026-65584No exploit	GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfoimagination technologies · graphics ddk · CWE-121 Local privilege escalation Memory safety	High7.8	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-65586No exploit	GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKMimagination technologies · graphics ddk · CWE-416 Local privilege escalation Memory safety	High7.1	—	0.1%	Oct 30, 2026
39Monitor	CVE-2026-74912No exploit	GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GBimagination technologies · graphics ddk · CWE-823 Pre-auth	Critical9.8	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-74915No exploit	GPU DDK - OOB write in UntwiddlePOTSquare64bppimagination technologies · graphics ddk · CWE-823	High8.8	—	0.2%	Oct 30, 2026
39Monitor	CVE-2026-107249No exploit	Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192drupal · block ajax · CWE-915 Pre-auth	Critical9.8	—	0.3%	Oct 30, 2026

CVE-2026-107056
36Monitor
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-107057
39Monitor
An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Oct 29, 2026
CVE-2026-107058
39Monitor
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
Oct 29, 2026
CVE-2026-107059
30Monitor
An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker cont
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
Oct 29, 2026
CVE-2026-107060
36Monitor
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN config
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 29, 2026
CVE-2026-115805
31Monitor
Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
rapid7 · insight agentOct 29, 2026
CVE-2026-118758
30Monitor
Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
kubeflow · pipelinesOct 29, 2026
CVE-2026-118759
30Monitor
Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
kubeflow · pipelinesOct 29, 2026
CVE-2026-118761
30Monitor
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
kubeflow · pipelinesOct 29, 2026
CVE-2026-118762
37Monitor
Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
monkeytypegame · monkeytypeOct 29, 2026
CVE-2026-118763
29Monitor
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Info leak
sigstore · sigstore-jsOct 29, 2026
CVE-2026-118765
29Monitor
Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state
HighCVSS 7.3No exploitEPSS 0%
randombit · botanOct 29, 2026
CVE-2026-119115
33Monitor
Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes
HighCVSS 8.4No exploitEPSS 0%
- Broken access control (IDOR)
aws · aws-privateca-issuerOct 29, 2026
CVE-2026-11587
28Monitor
Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
centreon · centreonOct 29, 2026
CVE-2026-62374
28Monitor
SD JWT JS: Tampered disclosures silently dropped instead of rejected
HighCVSS 7.1No exploitEPSS 0%
openwallet-foundation · @sd-jwt/coreOct 29, 2026
CVE-2026-107347
33Monitor
Nomad dispatch payload writes can escape the allocation directory through symlinks
HighCVSS 8.4No exploitEPSS 0%
hashicorp · nomadOct 29, 2026
CVE-2026-118769
36Monitor
Botan: Integer overflow when reporting block size in FFI can cause memory corruption
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Memory safety
randombit · botanOct 29, 2026
CVE-2026-51851
30Monitor
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_f
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Oct 29, 2026
CVE-2026-51863
36Monitor
DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:12
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
Oct 29, 2026
CVE-2026-51903
32Monitor
SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-51905
35Monitor
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/a
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
Oct 29, 2026
CVE-2026-51912
39Monitor
OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
Oct 29, 2026
CVE-2026-103093
37Monitor
Sandbox Escape via Table Rotation in ServiceNow AI Platform
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
servicenow · servicenow ai platformOct 29, 2026
CVE-2026-103094
28Monitor
Cleartext Storage of OAuth Credentials in ServiceNow AI Platform
HighCVSS 7.1No exploitEPSS 0%
servicenow · servicenow ai platformOct 29, 2026
CVE-2026-118772
30Monitor
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
hapijs · joiOct 29, 2026
CVE-2026-118776
21Monitor
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
digitalbazaar · forgeOct 29, 2026
CVE-2026-118779
30Monitor
Forge: Regular expression denial of service in PEM decoding (pem.decode)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
digitalbazaar · forgeOct 29, 2026
CVE-2026-118782
30Monitor
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
digitalbazaar · forgeOct 29, 2026
CVE-2026-119168
35Monitor
Nomad allocation data migration may allow host directory permission modification via symlink following
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
hashicorp · nomadOct 29, 2026
CVE-2026-119249
30Monitor
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ubiquiti inc · wifiman desktop for macosOct 29, 2026
CVE-2026-119250
31Monitor
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Path traversal
- Local privilege escalation
ubiquiti inc · wifiman desktop for macosOct 29, 2026
CVE-2026-41216
30Monitor
An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
vtk · vtkOct 29, 2026
CVE-2026-42057
30Monitor
An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
vtk · vtkOct 29, 2026
CVE-2026-8822
30Monitor
A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1).
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
vtk · vtkOct 29, 2026
CVE-2026-8824
30Monitor
A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1).
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
vtk · vtkOct 29, 2026
CVE-2026-9535
32Monitor
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1).
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
vtk · vtkOct 29, 2026
CVE-2026-9536
30Monitor
A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1).
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
vtk · vtkOct 29, 2026
CVE-2026-119187
30Monitor
Forge: Denial of service in TLS record processing via call stack exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
digitalbazaar · forgeOct 29, 2026
CVE-2026-119188
30Monitor
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
digitalbazaar · forgeOct 29, 2026
CVE-2026-119190
29Monitor
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
digitalbazaar · forgeOct 29, 2026
CVE-2026-119191
30Monitor
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
digitalbazaar · forgeOct 29, 2026
CVE-2026-119194
30Monitor
pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pyasn1 · pyasn1Oct 29, 2026
CVE-2026-119195
30Monitor
pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pyasn1 · pyasn1Oct 29, 2026
CVE-2026-119196
30Monitor
pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pyasn1 · pyasn1Oct 29, 2026
CVE-2026-119197
30Monitor
pyasn1: Quadratic-complexity denial of service in binary REAL decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pyasn1 · pyasn1Oct 29, 2026
CVE-2026-51831
31Monitor
An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to ex
HighCVSS 7.8No exploitEPSS 0%
- RCE
Oct 29, 2026
CVE-2026-51832
31Monitor
An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to ex
HighCVSS 7.8No exploitEPSS 0%
- RCE
Oct 29, 2026
CVE-2026-92092
29Monitor
Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification
HighCVSS 7.4No exploitEPSS 0%
- pre-auth RCE
red hat · red hat openshift container platform 4Oct 29, 2026
CVE-2026-119200
26Monitor
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
nuxt · nuxtOct 29, 2026
CVE-2026-119202
30Monitor
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
hapijs · contentOct 29, 2026
CVE-2026-119203
28Monitor
pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 29, 2026
CVE-2026-119204
28Monitor
pypdf: Possible large memory usage when parsing page tree
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 29, 2026
CVE-2026-119205
28Monitor
pypdf: Possible infinite loop when cloning dictionaries
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 29, 2026
CVE-2026-119206
28Monitor
pypdf: Possible long runtimes when retrieving page labels
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 29, 2026
CVE-2026-119207
28Monitor
pypdf: Possible large memory usage for exceptions in strict mode
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 29, 2026
CVE-2026-119208
28Monitor
pypdf: Possible long runtimes/large memory usage for encrypted PDF files
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 29, 2026
CVE-2026-119209
28Monitor
pypdf: Possible large memory usage when parsing cross-reference streams
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfOct 29, 2026
CVE-2026-119325
30Monitor
Bricks Theme Broken Access Control via load_popup_content
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
bricks · bricks themeOct 29, 2026
CVE-2026-13303
34Monitor
Boundary vulnerable to server-side request forgery in Vault credential store
HighCVSS 8.7No exploitEPSS 0%
- SSRF
hashicorp · boundaryOct 29, 2026
CVE-2026-61576
33Monitor
Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Path traversal
lightdash · lightdashOct 29, 2026
CVE-2026-115943
39Monitor
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Oct 29, 2026
CVE-2026-119282
29Monitor
Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
nrwl · nxOct 29, 2026
CVE-2026-119283
30Monitor
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
authlib · joserfcOct 29, 2026
CVE-2026-119286
30Monitor
GraphQL-core: Denial of service via memory leak in aborted validations
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
graphql-python · graphql-coreOct 29, 2026
CVE-2026-45049
33Monitor
OpenAM Session Hijacking via CDSSO
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
openidentityplatform · openamOct 29, 2026
CVE-2026-61645
36Monitor
Docat has Arbitrary File Upload exists in Upload API
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Path traversal
- File upload
docat-org · docatOct 29, 2026
CVE-2026-61654
33Monitor
Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- SQL injection
- Path traversal
lightdash · lightdashOct 29, 2026
CVE-2026-61671
32Monitor
WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
- CSRF
labredescefetrj · wegiaOct 29, 2026
CVE-2026-61707
36Monitor
SOCFortress CoPilot: Stored case-report template injection permits backend code execution
CriticalCVSS 9.0No exploitEPSS 0%
- RCE
- SSTI
socfortress · copilotOct 29, 2026
CVE-2026-61719
35Monitor
WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
HighCVSS 8.9No exploitEPSS 0%
- XSS
labredescefetrj · wegiaOct 29, 2026
CVE-2023-22793
37Monitor
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Exte
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Deserialization
veeam · management pack for microsoft system centerOct 29, 2026
CVE-2026-107238
34Monitor
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running t
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Deserialization
veeam · management pack for microsoft system centerOct 29, 2026
CVE-2026-107239
35Monitor
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers runni
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
veeam · management pack for microsoft system centerOct 29, 2026
CVE-2026-92744
34Monitor
Delinea Privilege Manager agent unauthenticated remote code execution vulnerability
HighCVSS 8.7Proof of conceptEPSS 0%
- RCE
- Weak crypto
delinea · privilege managerOct 29, 2026
CVE-2026-119260
35Monitor
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 30, 2026
CVE-2026-119261
38Monitor
Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potent
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 30, 2026
CVE-2026-119262
35Monitor
Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 30, 2026
CVE-2026-119263
38Monitor
Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the s
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 30, 2026
CVE-2026-119264
35Monitor
Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the s
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 30, 2026
CVE-2026-119265
35Monitor
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer p
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 30, 2026
CVE-2026-119266
35Monitor
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer p
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 30, 2026
CVE-2026-119267
35Monitor
Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 30, 2026
CVE-2026-119268
35Monitor
Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 30, 2026
CVE-2026-119269
35Monitor
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 30, 2026
CVE-2026-119270
35Monitor
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the ren
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 30, 2026
CVE-2026-119271
35Monitor
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
google · chromeOct 30, 2026
CVE-2026-76025
35Monitor
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to exe
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 30, 2026
CVE-2026-76026
35Monitor
Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a craf
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 30, 2026
CVE-2026-76028
35Monitor
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to exe
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 30, 2026
CVE-2026-76029
35Monitor
Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 30, 2026
CVE-2026-76030
35Monitor
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to pot
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 30, 2026
CVE-2026-76031
35Monitor
Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass w
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 30, 2026
CVE-2026-15466
28Monitor
GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Memory safety
- Race condition
imagination technologies · graphics ddkOct 30, 2026
CVE-2026-18629
30Monitor
GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
imagination technologies · graphics ddkOct 30, 2026
CVE-2026-19199
28Monitor
GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
- Memory safety
imagination technologies · graphics ddkOct 30, 2026
CVE-2026-65584
31Monitor
GPU DDK - Stack Buffer Overflow via undersized UFO address array in DumpStalledContextInfo
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
imagination technologies · graphics ddkOct 30, 2026
CVE-2026-65586
28Monitor
GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
- Memory safety
imagination technologies · graphics ddkOct 30, 2026
CVE-2026-74912
39Monitor
GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
imagination technologies · graphics ddkOct 30, 2026
CVE-2026-74915
35Monitor
GPU DDK - OOB write in UntwiddlePOTSquare64bpp
HighCVSS 8.8No exploitEPSS 0%
imagination technologies · graphics ddkOct 30, 2026
CVE-2026-107249
39Monitor
Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
drupal · block ajaxOct 30, 2026