By publication date

Exploited and new serious CVEs: October 2026

8,744 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 85 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-114538No exploit	Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236drupal · bootstrap · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 30, 2026
35Monitor	CVE-2026-114573No exploit	Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253drupal · monster menus · CWE-915	High8.8	—	0.2%	Oct 30, 2026
26Monitor	CVE-2026-118539Proof of concept	Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254drupal · commerce core · CWE-862 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.6%	Oct 30, 2026
28Monitor	CVE-2026-118549No exploit	AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269drupal · ai (artificial intelligence) · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 30, 2026
29Monitor	CVE-2026-118558No exploit	Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263drupal · commerce stripe · CWE-352 Pre-auth CSRF	High7.3	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-118561No exploit	Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274drupal · single content sync · CWE-73 Path traversal	High7.2	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-118562No exploit	Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275drupal · single content sync · CWE-502 RCE Deserialization	High7.2	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-118565No exploit	GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278drupal · groupex pro ( daxko ) integration · CWE-20	High7.2	—	0.1%	Oct 30, 2026
21Monitor	CVE-2026-118569Proof of concept	Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282drupal · fasttoggle · CWE-863 Broken access control (IDOR)	Medium5.4	—	0.1%	Oct 30, 2026
26Monitor	CVE-2026-118570Proof of concept	Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283drupal · fasttoggle · CWE-352 Pre-auth CSRF	Medium6.5	—	0.1%	Oct 30, 2026
29Monitor	CVE-2026-118582No exploit	CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281drupal · captcha · CWE-288 Pre-auth Auth bypass	High7.3	—	0.1%	Oct 30, 2026
30Monitor	CVE-2026-103963No exploit	Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of servicered hat · red hat enterprise linux 10 · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-104368No exploit	Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip webtoffee · export and import users and customers · CWE-116	High8.8	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-114422No exploit	Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacerunknown · enable media replace · CWE-502 pre-auth RCE Deserialization	High7.5	—	0.4%	Oct 30, 2026
30Monitor	CVE-2026-114443No exploit	Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Codeunknown · security plugin, firewall & malware scanner with auto removal · CWE-287 Auth bypass	High7.5	—	0.1%	Oct 30, 2026
35Monitor	CVE-2026-117571No exploit	WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parametersunknown · wp visitor statistics (real time traffic) · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 30, 2026
39Monitor	CVE-2026-103039Proof of concept	Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Fieldgravity forms · gravity forms · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.5%	Oct 30, 2026
30Monitor	CVE-2026-110732No exploit	AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Clientigroumeow · ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & gemini · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-116622No exploit	Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookiewpscripts · food store – online food delivery & pickup · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-89435No exploit	Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameterstrategy11team · formidable forms – contact form, survey, quiz, payment, calculator form & custom form builder · CWE-74	High8.8	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-90437No exploit	Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Valuesgravity forms · gravity forms · CWE-79 Pre-auth XSS	High7.2	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-97645No exploit	Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Fieldgravity forms · gravity forms · CWE-79 Pre-auth XSS	High7.2	—	0.1%	Oct 30, 2026
37Monitor	CVE-2026-82104No exploit	API permission bypass via logic bugteltonika networks · rut · CWE-306 pre-auth RCE Auth bypass	Critical9.4	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-59387No exploit	Broken access control restriction in Cloud Controller APIcloud foundry · capi (cloud controller api) · CWE-284 Auth bypass Broken access control (IDOR)	High8.8	—	0.2%	Oct 30, 2026
39Monitor	CVE-2026-64618No exploit	Apache Fineract: SQL injection vulnerability in Search APIapache · fineract · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.6%	Oct 30, 2026
35Monitor	CVE-2026-65874No exploit	Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpointsapache · fineract · CWE-89 SQL injection	High8.8	—	0.5%	Oct 30, 2026
32Monitor	CVE-2026-14467No exploit	Display of information in the Forocoches comments editorforocoches · forocoches comments editor · CWE-200 Info leak	High8.2	—	0.2%	Oct 30, 2026
39Monitor	CVE-2025-31704No exploit	Dahua Intelligent Connection Center command injectiondahua · intelligent connection center · CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.3%	Oct 30, 2026
38Monitor	CVE-2026-116366Proof of concept	Unauthenticated RCE vulnerability against ClickHouse Serverclickhouse · clickhouse · CWE-190 pre-auth RCE Memory safety	Critical9.5	—	0.9%	Oct 30, 2026
34Monitor	CVE-2026-22105No exploit	Use of default password based on serial numberdelta electronics · delta ufc500 · CWE-1392 Pre-auth Hard-coded credentials	High8.7	—	0.1%	Oct 30, 2026
33Monitor	CVE-2026-22109No exploit	Default WebUI passwords stored in plaintextdelta electronics · delta ufc500 · CWE-1392 Hard-coded credentials	High8.4	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-22110No exploit	Missing authentication check on POST/PUT requestsdelta electronics · delta ufc500 · CWE-306 Pre-auth Auth bypass	High8.7	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-85268No exploit	Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle IDgoogle cloud · identity platform and firebase authentication · CWE-79 pre-auth RCE XSS	High8.7	—	0.5%	Oct 30, 2026
30Monitor	RUSTSEC-2026-0425No exploit	`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal) Pre-auth Path traversal	High7.5	—	—	Oct 30, 2026
28Monitor	RUSTSEC-2026-0450No exploit	`ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal) Path traversal	High7.1	—	—	Oct 30, 2026
33Monitor	CVE-2025-68393No exploit	SQL Injection in Protectelarketeam · protectelmaj · CWE-89 SQL injection	High8.4	—	0.2%	Oct 30, 2026
33Monitor	CVE-2025-68394No exploit	SQL Injection in Protectelarketeam · protectelmaj · CWE-89 SQL injection	High8.4	—	0.2%	Oct 30, 2026
29Monitor	CVE-2026-101210No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Commdell · openmanage enterprise · CWE-78 RCE Command injection	High7.2	—	2.8%	Oct 30, 2026
31Monitor	CVE-2026-101213No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability.dell · openmanage enterprise · CWE-269 Local privilege escalation	High7.8	—	0.1%	Oct 30, 2026
29Monitor	CVE-2026-101214No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Commdell · openmanage enterprise · CWE-78 RCE Command injection	High7.2	—	2.8%	Oct 30, 2026
30Monitor	CVE-2026-110971No exploit	Weak password encoding in Płatnikzakład ubezpieczeń społecznych · płatnik · CWE-261 Pre-auth	High7.7	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-110972No exploit	Use of Client-Side Authentication in Płatnikzakład ubezpieczeń społecznych · płatnik · CWE-603	High8.6	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-111504No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injedell · openmanage enterprise · CWE-88	High7.2	—	0.4%	Oct 30, 2026
35Monitor	CVE-2026-111505No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Commdell · openmanage enterprise · CWE-78 RCE Command injection	High8.8	—	1.4%	Oct 30, 2026
34Monitor	CVE-2026-119373No exploit	SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()sqlite · sqlite · CWE-787 Memory safety	High8.5	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-119374No exploit	SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()sqlite · sqlite · CWE-787 Memory safety	High8.5	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-119379No exploit	SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()sqlite · sqlite · CWE-787 Memory safety	High8.5	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-119407No exploit	Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameterselement-hq · element-web · CWE-352 Pre-auth CSRF	High7.1	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-119408No exploit	n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodesn8n-io · n8n · CWE-653 RCE	High8.7	—	0.6%	Oct 30, 2026
35Monitor	CVE-2026-119409No exploit	OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Settingopnsense · core · CWE-78 RCE Command injection	High8.6	—	2.4%	Oct 30, 2026
36Monitor	CVE-2026-119418No exploit	CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()cakephp · cakephp · CWE-89 Pre-auth SQL injection	Critical9.2	—	0.4%	Oct 30, 2026
36Monitor	CVE-2026-119419No exploit	CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collationcakephp · cakephp · CWE-89 Pre-auth SQL injection	Critical9.2	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-119420No exploit	Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutationgetlago · lago · CWE-288 Auth bypass	High8.7	—	0.3%	Oct 30, 2026
32Monitor	CVE-2026-119421No exploit	Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmationjuspay · hyperswitch · CWE-639 Pre-auth Broken access control (IDOR)	High8.2	—	0.3%	Oct 30, 2026
32Monitor	CVE-2026-119422No exploit	Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connectorjuspay · hyperswitch · CWE-345 Pre-auth Auth bypass	High8.2	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-119426No exploit	phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sqlphpmyadmin · phpmyadmin · CWE-352 pre-auth RCE CSRF	High7.7	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-119549No exploit	Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Imagesjellyfin · jellyfin · CWE-918 SSRF	High7.1	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-119551No exploit	Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestionsjellyfin · jellyfin · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-119553No exploit	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversalmoodle project · moodle · CWE-23 Path traversal	High7.1	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-119557No exploit	n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Noden8n-io · n8n · CWE-22 Pre-auth Path traversal	High8.2	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-119559No exploit	OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatchlitespeedtech · openlitespeed · CWE-295 Pre-auth Auth bypass Weak crypto	High8.2	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-119561No exploit	phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServerphpmyadmin · phpmyadmin · CWE-347 Auth bypass Weak crypto	High7.6	—	0.2%	Oct 30, 2026
36Monitor	CVE-2026-119568No exploit	vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijackingvsftpd · vsftpd · CWE-940 Pre-auth Auth bypass	Critical9.1	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-119586No exploit	SQLite CLI through 3.54.1 Command Injection via .recover Outputsqlite · sqlite · CWE-77 RCE Command injection	High8.5	—	1.5%	Oct 30, 2026
28Monitor	CVE-2026-111503No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Indell · openmanage enterprise · CWE-89 SQL injection	High7.1	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-115865No exploit	Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memoryCWE-789 Pre-auth Denial of service	High7.5	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-115866No exploit	Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodiesCWE-1333 Pre-auth Denial of service	High7.5	—	0.2%	Oct 30, 2026
36Monitor	CVE-2026-116127No exploit	Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connectionCWE-444 Pre-auth	Critical9.1	—	0.1%	Oct 30, 2026
30Monitor	CVE-2026-116128No exploit	Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodiesCWE-770 Pre-auth Denial of service	High7.5	—	0.2%	Oct 30, 2026
36Monitor	CVE-2026-116130No exploit	HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_requestCWE-626 Pre-auth	Critical9.1	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-118988No exploit	CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc routeCWE-22 Pre-auth Path traversal	High7.5	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-118991No exploit	CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES keyCWE-916 Pre-auth	High7.5	—	0.1%	Oct 30, 2026
33Monitor	CVE-2026-118992No exploit	CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupCWE-78 RCE Command injection	High8.4	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-118993No exploit	CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGICWE-1333 Pre-auth Denial of service	High7.5	—	0.1%	Oct 30, 2026
39Monitor	CVE-2026-118994No exploit	CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameCWE-117 Pre-auth	Critical9.8	—	0.2%	Oct 30, 2026
36Monitor	CVE-2026-118995No exploit	CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidatorCWE-625 Pre-auth	Critical9.1	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-119036No exploit	Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signatureCWE-770 Pre-auth Denial of service	High7.5	—	0.1%	Oct 30, 2026
30Monitor	CVE-2026-119037No exploit	Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or emptyCWE-347 Pre-auth Weak crypto	High7.5	—	0.1%	Oct 30, 2026
30Monitor	CVE-2026-13576No exploit	CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashesCWE-759 Pre-auth	High7.5	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-75882No exploit	Improper access control vulnerability in ESET Encryption products for Windowseset spol. s.r.o. · eset endpoint encryption · CWE-284 Local privilege escalation Broken access control (IDOR)	High8.5	—	0.0%	Oct 30, 2026
30Monitor	CVE-2026-87768No exploit	DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding secondsCWE-407 Pre-auth Denial of service	High7.5	—	0.1%	Oct 30, 2026
32Monitor	CVE-2026-91917No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability.dell · openmanage enterprise · CWE-20	High8.0	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-112347No exploit	Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page APIthemeum · kirki · CWE-862 Broken access control (IDOR)	High7.2	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-118986No exploit	CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()CWE-338 Pre-auth Weak crypto	High7.5	—	0.1%	Oct 30, 2026
31Monitor	CVE-2026-119528No exploit	Gimp: gimp: stack buffer overflow in psd image resource header loaderred hat · red hat enterprise linux 10 · CWE-121 RCE Memory safety	High7.8	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-119572No exploit	Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Providertraefik · traefik · CWE-287 Pre-auth Auth bypass	High7.0	—	0.1%	Oct 30, 2026
32Monitor	CVE-2026-119574No exploit	Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Servicetraefik · traefik · CWE-567 Pre-auth	High8.2	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-119575No exploit	ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block Listarcadedata · arcadedb · CWE-918 SSRF	High7.1	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-119577No exploit	ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connectionsarcadedata · arcadedb · CWE-613	High7.6	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-119578No exploit	MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()project-monai · monai · CWE-470 RCE	High8.5	—	0.5%	Oct 30, 2026
37Monitor	CVE-2026-119597No exploit	OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgeryaidotnet · opendeepwiki · CWE-321 Pre-auth Hard-coded credentials	Critical9.3	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-86715No exploit	Clear Text Storage of Password in Crypttech's Vatos DLPcrypttech crypto and informatics technologies industry and trade inc. · vatos dlp · CWE-256	High7.1	—	0.1%	Oct 30, 2026
36Monitor	CVE-2026-91913No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Commdell · openmanage enterprise · CWE-78 RCE Command injection	High8.8	—	2.7%	Oct 30, 2026
28Monitor	CVE-2026-91914No exploit	Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability.dell · openmanage enterprise · CWE-290 Pre-auth Auth bypass	High7.1	—	0.2%	Oct 30, 2026
34Monitor	CVE-2010-20125No exploit	DedeCMS < 5.7 File Inclusion via plus/carbuyaction.phpdedecms · dedecms · CWE-98 Pre-auth Path traversal	High8.7	—	0.5%	Oct 30, 2026
39Monitor	CVE-2026-110799No exploit	Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeovergivanz · vvveb · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.7%	Oct 30, 2026
36Monitor	CVE-2026-112905No exploit	Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theftgivanz · vvveb · CWE-285 Broken access control (IDOR)	Critical9.0	—	0.4%	Oct 30, 2026
30Monitor	CVE-2026-117346No exploit	Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limitCWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-119645No exploit	ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoceasysoft · zentaopms · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-119649No exploit	Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Checkorchardcms · orchard · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Oct 30, 2026

CVE-2026-114538
28Monitor
Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
drupal · bootstrapOct 30, 2026
CVE-2026-114573
35Monitor
Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253
HighCVSS 8.8No exploitEPSS 0%
drupal · monster menusOct 30, 2026
CVE-2026-118539
26Monitor
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
drupal · commerce coreOct 30, 2026
CVE-2026-118549
28Monitor
AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
drupal · ai (artificial intelligence)Oct 30, 2026
CVE-2026-118558
29Monitor
Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- CSRF
drupal · commerce stripeOct 30, 2026
CVE-2026-118561
28Monitor
Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
drupal · single content syncOct 30, 2026
CVE-2026-118562
28Monitor
Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Deserialization
drupal · single content syncOct 30, 2026
CVE-2026-118565
28Monitor
GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278
HighCVSS 7.2No exploitEPSS 0%
drupal · groupex pro ( daxko ) integrationOct 30, 2026
CVE-2026-118569
21Monitor
Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282
MediumCVSS 5.4Proof of conceptEPSS 0%
- Broken access control (IDOR)
drupal · fasttoggleOct 30, 2026
CVE-2026-118570
26Monitor
Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- CSRF
drupal · fasttoggleOct 30, 2026
CVE-2026-118582
29Monitor
CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
drupal · captchaOct 30, 2026
CVE-2026-103963
30Monitor
Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 10Oct 30, 2026
CVE-2026-104368
35Monitor
Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip
HighCVSS 8.8No exploitEPSS 0%
webtoffee · export and import users and customersOct 30, 2026
CVE-2026-114422
30Monitor
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Deserialization
unknown · enable media replaceOct 30, 2026
CVE-2026-114443
30Monitor
Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · security plugin, firewall & malware scanner with auto removalOct 30, 2026
CVE-2026-117571
35Monitor
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · wp visitor statistics (real time traffic)Oct 30, 2026
CVE-2026-103039
39Monitor
Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Deserialization
gravity forms · gravity formsOct 30, 2026
CVE-2026-110732
30Monitor
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Clien
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
tigroumeow · ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & geminiOct 30, 2026
CVE-2026-116622
28Monitor
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpscripts · food store – online food delivery & pickupOct 30, 2026
CVE-2026-89435
35Monitor
Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
HighCVSS 8.8No exploitEPSS 0%
strategy11team · formidable forms – contact form, survey, quiz, payment, calculator form & custom form builderOct 30, 2026
CVE-2026-90437
28Monitor
Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
gravity forms · gravity formsOct 30, 2026
CVE-2026-97645
28Monitor
Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
gravity forms · gravity formsOct 30, 2026
CVE-2026-82104
37Monitor
API permission bypass via logic bug
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
teltonika networks · rutOct 30, 2026
CVE-2026-59387
35Monitor
Broken access control restriction in Cloud Controller API
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
cloud foundry · capi (cloud controller api)Oct 30, 2026
CVE-2026-64618
39Monitor
Apache Fineract: SQL injection vulnerability in Search API
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
apache · fineractOct 30, 2026
CVE-2026-65874
35Monitor
Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
apache · fineractOct 30, 2026
CVE-2026-14467
32Monitor
Display of information in the Forocoches comments editor
HighCVSS 8.2No exploitEPSS 0%
- Info leak
forocoches · forocoches comments editorOct 30, 2026
CVE-2025-31704
39Monitor
Dahua Intelligent Connection Center command injection
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
dahua · intelligent connection centerOct 30, 2026
CVE-2026-116366
38Monitor
Unauthenticated RCE vulnerability against ClickHouse Server
CriticalCVSS 9.5Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
clickhouse · clickhouseOct 30, 2026
CVE-2026-22105
34Monitor
Use of default password based on serial number
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
delta electronics · delta ufc500Oct 30, 2026
CVE-2026-22109
33Monitor
Default WebUI passwords stored in plaintext
HighCVSS 8.4No exploitEPSS 0%
- Hard-coded credentials
delta electronics · delta ufc500Oct 30, 2026
CVE-2026-22110
34Monitor
Missing authentication check on POST/PUT requests
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
delta electronics · delta ufc500Oct 30, 2026
CVE-2026-85268
34Monitor
Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- XSS
google cloud · identity platform and firebase authenticationOct 30, 2026
RUSTSEC-2026-0425
30Monitor
`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)
HighCVSS 7.5No exploit
- Pre-auth
- Path traversal
Oct 30, 2026
RUSTSEC-2026-0450
28Monitor
`ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)
HighCVSS 7.1No exploit
- Path traversal
Oct 30, 2026
CVE-2025-68393
33Monitor
SQL Injection in Protectel
HighCVSS 8.4No exploitEPSS 0%
- SQL injection
arketeam · protectelmajOct 30, 2026
CVE-2025-68394
33Monitor
SQL Injection in Protectel
HighCVSS 8.4No exploitEPSS 0%
- SQL injection
arketeam · protectelmajOct 30, 2026
CVE-2026-101210
29Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · openmanage enterpriseOct 30, 2026
CVE-2026-101213
31Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
dell · openmanage enterpriseOct 30, 2026
CVE-2026-101214
29Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
dell · openmanage enterpriseOct 30, 2026
CVE-2026-110971
30Monitor
Weak password encoding in Płatnik
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
zakład ubezpieczeń społecznych · płatnikOct 30, 2026
CVE-2026-110972
34Monitor
Use of Client-Side Authentication in Płatnik
HighCVSS 8.6No exploitEPSS 0%
zakład ubezpieczeń społecznych · płatnikOct 30, 2026
CVE-2026-111504
28Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Inje
HighCVSS 7.2No exploitEPSS 0%
dell · openmanage enterpriseOct 30, 2026
CVE-2026-111505
35Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
dell · openmanage enterpriseOct 30, 2026
CVE-2026-119373
34Monitor
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
sqlite · sqliteOct 30, 2026
CVE-2026-119374
34Monitor
SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
sqlite · sqliteOct 30, 2026
CVE-2026-119379
34Monitor
SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
sqlite · sqliteOct 30, 2026
CVE-2026-119407
28Monitor
Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
element-hq · element-webOct 30, 2026
CVE-2026-119408
34Monitor
n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
HighCVSS 8.7No exploitEPSS 0%
- RCE
n8n-io · n8nOct 30, 2026
CVE-2026-119409
35Monitor
OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
opnsense · coreOct 30, 2026
CVE-2026-119418
36Monitor
CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- SQL injection
cakephp · cakephpOct 30, 2026
CVE-2026-119419
36Monitor
CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- SQL injection
cakephp · cakephpOct 30, 2026
CVE-2026-119420
34Monitor
Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
getlago · lagoOct 30, 2026
CVE-2026-119421
32Monitor
Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
juspay · hyperswitchOct 30, 2026
CVE-2026-119422
32Monitor
Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
juspay · hyperswitchOct 30, 2026
CVE-2026-119426
30Monitor
phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- CSRF
phpmyadmin · phpmyadminOct 30, 2026
CVE-2026-119549
28Monitor
Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
HighCVSS 7.1No exploitEPSS 0%
- SSRF
jellyfin · jellyfinOct 30, 2026
CVE-2026-119551
28Monitor
Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jellyfin · jellyfinOct 30, 2026
CVE-2026-119553
28Monitor
Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
moodle project · moodleOct 30, 2026
CVE-2026-119557
32Monitor
n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
n8n-io · n8nOct 30, 2026
CVE-2026-119559
32Monitor
OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
litespeedtech · openlitespeedOct 30, 2026
CVE-2026-119561
30Monitor
phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
HighCVSS 7.6No exploitEPSS 0%
- Auth bypass
- Weak crypto
phpmyadmin · phpmyadminOct 30, 2026
CVE-2026-119568
36Monitor
vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
vsftpd · vsftpdOct 30, 2026
CVE-2026-119586
34Monitor
SQLite CLI through 3.54.1 Command Injection via .recover Output
HighCVSS 8.5No exploitEPSS 1%
- RCE
- Command injection
sqlite · sqliteOct 30, 2026
CVE-2026-111503
28Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL In
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
dell · openmanage enterpriseOct 30, 2026
CVE-2026-115865
30Monitor
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-115866
30Monitor
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-116127
36Monitor
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 30, 2026
CVE-2026-116128
30Monitor
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-116130
36Monitor
HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 30, 2026
CVE-2026-118988
30Monitor
CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Oct 30, 2026
CVE-2026-118991
30Monitor
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 30, 2026
CVE-2026-118992
33Monitor
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Command injection
Oct 30, 2026
CVE-2026-118993
30Monitor
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-118994
39Monitor
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
Oct 30, 2026
CVE-2026-118995
36Monitor
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Oct 30, 2026
CVE-2026-119036
30Monitor
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-119037
30Monitor
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
Oct 30, 2026
CVE-2026-13576
30Monitor
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 30, 2026
CVE-2026-75882
34Monitor
Improper access control vulnerability in ESET Encryption products for Windows
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
eset spol. s.r.o. · eset endpoint encryptionOct 30, 2026
CVE-2026-87768
30Monitor
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-91917
32Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability.
HighCVSS 8.0No exploitEPSS 0%
dell · openmanage enterpriseOct 30, 2026
CVE-2026-112347
28Monitor
Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
themeum · kirkiOct 30, 2026
CVE-2026-118986
30Monitor
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
Oct 30, 2026
CVE-2026-119528
31Monitor
Gimp: gimp: stack buffer overflow in psd image resource header loader
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 10Oct 30, 2026
CVE-2026-119572
28Monitor
Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikOct 30, 2026
CVE-2026-119574
32Monitor
Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
traefik · traefikOct 30, 2026
CVE-2026-119575
28Monitor
ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
HighCVSS 7.1No exploitEPSS 0%
- SSRF
arcadedata · arcadedbOct 30, 2026
CVE-2026-119577
30Monitor
ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
HighCVSS 7.6No exploitEPSS 0%
arcadedata · arcadedbOct 30, 2026
CVE-2026-119578
34Monitor
MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()
HighCVSS 8.5No exploitEPSS 0%
- RCE
project-monai · monaiOct 30, 2026
CVE-2026-119597
37Monitor
OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
aidotnet · opendeepwikiOct 30, 2026
CVE-2026-86715
28Monitor
Clear Text Storage of Password in Crypttech's Vatos DLP
HighCVSS 7.1No exploitEPSS 0%
crypttech crypto and informatics technologies industry and trade inc. · vatos dlpOct 30, 2026
CVE-2026-91913
36Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Comm
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
dell · openmanage enterpriseOct 30, 2026
CVE-2026-91914
28Monitor
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability.
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · openmanage enterpriseOct 30, 2026
CVE-2010-20125
34Monitor
DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
dedecms · dedecmsOct 30, 2026
CVE-2026-110799
39Monitor
Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
givanz · vvvebOct 30, 2026
CVE-2026-112905
36Monitor
Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
CriticalCVSS 9.0No exploitEPSS 0%
- Broken access control (IDOR)
givanz · vvvebOct 30, 2026
CVE-2026-117346
30Monitor
Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-119645
28Monitor
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
easysoft · zentaopmsOct 30, 2026
CVE-2026-119649
28Monitor
Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
orchardcms · orchardOct 30, 2026