By publication date

Exploited and new serious CVEs: October 2026

8,744 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 87 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-62160No exploit	Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewaredaptin · daptin · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-62162No exploit	Hydra: Deposit Claim omits Head state-token spending requirementcardano-scaling · hydra · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-62264No exploit	PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYsylphxai · pdf-reader-mcp · CWE-200 Pre-auth SSRF Info leak	High7.5	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-62331No exploit	praktor: Telegram upload traversal permits persistent agent instruction injectionmtzanidakis · praktor · CWE-22 Pre-auth Path traversal	High8.2	—	0.7%	Oct 30, 2026
35Monitor	CVE-2026-73186No exploit	WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerabilityshortpixel · enable media replace · CWE-502 Deserialization	High8.8	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-78527No exploit	WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerabilitygs plugins · gs testimonial slider · CWE-502 Deserialization	High8.8	—	0.3%	Oct 30, 2026
39Monitor	CVE-2026-90888No exploit	WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerabilityleadsnap · leadsnap · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-94175No exploit	WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitysaad iqbal · all in one login · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 30, 2026
37Monitor	CVE-2026-115828No exploit	Secret Server device validation errordelinea · secret server · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.4	—	0.3%	Oct 30, 2026
39Monitor	CVE-2026-115829No exploit	Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Forcedelinea · secret server · CWE-288 Pre-auth Auth bypass	Critical9.9	—	0.5%	Oct 30, 2026
34Monitor	CVE-2026-115830No exploit	Secret Server JWT issuance errordelinea · secret server · CWE-863 Broken access control (IDOR)	High8.7	—	0.2%	Oct 30, 2026
36Monitor	CVE-2026-116238No exploit	pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checkspgadmin.org · pgadmin 4 · CWE-307 Pre-auth	Critical9.2	—	0.4%	Oct 30, 2026
35Monitor	CVE-2026-116239No exploit	pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernamepgadmin · pgadmin 4 · CWE-287 Auth bypass	High8.9	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-116240No exploit	pgAdmin 4: File Manager and storage-path tools act on a different path from the one checkedpgadmin · pgadmin 4 · CWE-22 Path traversal	High7.1	—	0.2%	Oct 30, 2026
37Monitor	CVE-2026-116241No exploit	pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierpgadmin · pgadmin 4 · CWE-78 RCE Command injection	Critical9.4	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-116242No exploit	pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identitypgadmin · pgadmin 4 · CWE-522 Info leak	High7.1	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-116243No exploit	pgAdmin 4: Utility binary path can point at a shared storage directorypgadmin · pgadmin 4 · CWE-426	High7.7	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-116244Proof of concept	pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialspgadmin · pgadmin 4 · CWE-522 Hard-coded credentials Info leak	High7.1	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-116245No exploit	pgAdmin 4: Connection services are not restricted in server modepgadmin · pgadmin 4 · CWE-522 Info leak	High7.1	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-116246No exploit	pgAdmin 4: Server passwords are left in pgAdmin's process environmentpgadmin · pgadmin 4 · CWE-214	High7.0	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-116247No exploit	pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificatepgadmin · pgadmin 4 · CWE-522 Info leak	High7.1	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-116249No exploit	pgAdmin 4: Connection file paths and parameter keys escape the user's storage directorypgadmin.org · pgadmin 4 · CWE-22 Path traversal	High7.2	—	0.1%	Oct 30, 2026
29Monitor	CVE-2026-116250No exploit	pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment checkpgadmin.org · pgadmin 4 · CWE-59 Open redirect	High7.3	—	0.0%	Oct 30, 2026
28Monitor	CVE-2026-116252No exploit	pgAdmin 4: Materialized view refresh redirects its connection through a crafted database namepgadmin · pgadmin 4 · CWE-88	High7.1	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-119331No exploit	Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutationladybirdbrowser · ladybird · CWE-200 Pre-auth Info leak	High7.1	—	0.1%	Oct 30, 2026
35Monitor	CVE-2026-119332No exploit	Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()ladybirdbrowser · ladybird · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Oct 30, 2026
31Monitor	CVE-2026-119333No exploit	draw.io Desktop allows Windows executable search-path hijackingjgraph · drawio-desktop · CWE-426	High7.8	—	0.1%	Oct 30, 2026
31Monitor	CVE-2026-119335No exploit	Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypasspi-hole · pi-hole · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.2%	Oct 30, 2026
31Monitor	CVE-2026-119336No exploit	Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlinkpi-hole · pi-hole · CWE-59	High7.8	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-119337No exploit	RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorizationinfiniflow · ragflow · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Oct 30, 2026
36Monitor	CVE-2026-55598No exploit	PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)madeofpendletonwool · pinepods · CWE-918 SSRF	Critical9.1	—	0.3%	Oct 30, 2026
39Monitor	CVE-2026-61620No exploit	HoneySQL unchecked entity names can lead to SQL injection resultsseancorfield · honeysql · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.3%	Oct 30, 2026
37Monitor	CVE-2026-61850No exploit	Kargo: Privilege escalation via Project RBAC management in the Kargo APIakuity · kargo · CWE-269	Critical9.3	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-62284No exploit	OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyosac-project · osac-operator · CWE-94 RCE SSRF	High8.6	—	0.5%	Oct 30, 2026
28Monitor	CVE-2026-62301No exploit	MyTube: Visitor Can Access Hidden Video Metadata and Contentfranklioxygen · mytube · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-62302No exploit	MyTube: Unauthenticated Media Access via Static Routes Bypassing Loginfranklioxygen · mytube · CWE-306 Pre-auth Auth bypass	High8.7	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-62333No exploit	OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory rootsopenvm-org · openvm · CWE-20 Pre-auth	High8.7	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-62334No exploit	OpenVM's OpenVmHalo2Verifier self-call can bypass proof verificationopenvm-org · openvm · CWE-754 Pre-auth	High8.7	—	0.5%	Oct 30, 2026
29Monitor	CVE-2026-78402No exploit	Stack Buffer Overflow in Sentinel Keys Serverthalesgroup · sentinel keys server · CWE-121 Local privilege escalation Memory safety	High7.3	—	0.1%	Oct 30, 2026
37Monitor	CVE-2026-78403No exploit	Unauthenticated Stack Buffer Overflow in Sentinel Keys Serverthalesgroup · sentinel keys server · CWE-121 pre-auth RCE Memory safety	Critical9.3	—	0.5%	Oct 30, 2026
36Monitor	CVE-2026-117666No exploit	ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundarydeadtrickster · ssl_verify_fun · CWE-297 Pre-auth Weak crypto	Critical9.1	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-40573No exploit	NovumOS: Nova Interpreter Privilege Escalationminecanton209 · novumos · CWE-250 Local privilege escalation	High8.6	—	0.1%	Oct 30, 2026
32Monitor	CVE-2026-58412No exploit	Filecoin Pin: Fork bypass in the privileged GitHub Actions workflowfilecoin-project · filecoin-pin · CWE-863 Pre-auth Broken access control (IDOR)	High8.2	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-62297No exploit	ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)agamnentzar · ag-psd · CWE-789 Pre-auth Denial of service	High7.5	—	0.3%	Oct 30, 2026
32Monitor	CVE-2026-62847No exploit	Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)metalama · metalama · CWE-377 Local privilege escalation	High8.2	—	0.1%	Oct 30, 2026
29Monitor	CVE-2026-62848No exploit	Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code executionmetalama · metalama · CWE-502 Deserialization	High7.3	—	0.1%	Oct 30, 2026
36Monitor	CVE-2026-62849No exploit	ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injectionmqttsnet · thinglinks · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.4%	Oct 30, 2026
39Monitor	CVE-2026-62853No exploit	ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinksmqttsnet · thinglinks · CWE-78 RCE Command injection	Critical9.9	—	0.4%	Oct 30, 2026
38Monitor	CVE-2026-62863No exploit	MoLing: unauthenticated SSE and wildcard CORS expose tool sessionsgojue · moling · CWE-306 Pre-auth Auth bypass	Critical9.6	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-62864No exploit	Ring's nested-params middleware has inefficient regular expression complexityring-clojure · ring · CWE-1333 Pre-auth Denial of service	High7.5	—	0.3%	Oct 30, 2026
31Monitor	CVE-2026-62958Proof of concept	libriscv: Out of bounds read vuln in the ELF parser (Denial of service)libriscv · libriscv · CWE-20	High7.9	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-62965No exploit	SABnzbd: Orphan-job path traversal permits arbitrary file deletionsabnzbd · sabnzbd · CWE-22 Path traversal	High7.0	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-62966No exploit	ESPAsyncWebServer multipart parser has null-pointer writeesp32async · espasyncwebserver · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-62967No exploit	ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUsersinamics · ztnet · CWE-862 Broken access control (IDOR)	High8.1	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-62968No exploit	Dream Displays has command-line argument injection in yt-dlp invocationarsmotorin · dreamdisplays · CWE-88 Pre-auth	High8.7	—	0.4%	Oct 30, 2026
33Monitor	CVE-2026-62979No exploit	jack: upstream error responses expose backend and peer credentialsroziscoding · jack · CWE-200 Info leak	High8.4	—	0.3%	Oct 30, 2026
32Monitor	CVE-2026-62989No exploit	Shopper: missing variant-delete authorization permits destructive single and bulk actionsshopperlabs · shopper · CWE-285 Broken access control (IDOR)	High8.1	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-62990No exploit	Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creationshopperlabs · shopper · CWE-79 XSS	High8.7	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-111578No exploit	PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fieldsunknown · pdf invoices & packing slips for woocommerce · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-118938No exploit	Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysistrailofbits · fickling · CWE-502 Pre-auth Deserialization	High8.8	—	0.4%	Oct 30, 2026
35Monitor	CVE-2026-16760No exploit	Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callablestrailofbits · fickling · CWE-502 Pre-auth Deserialization	High8.8	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-63182No exploit	LightSAML: Signature reference wrapping permits unsigned assertion claimslitesaml · lightsaml · CWE-347 Deserialization Weak crypto	High8.1	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-63184No exploit	Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusionchristianhelle · refitter · CWE-829 Pre-auth SSRF	High7.1	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-63201No exploit	netopeer2-server logging has format string vulnerability via subtree filtercesnet · netopeer2 · CWE-134	High7.1	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-63224No exploit	OpenRemote has authenticated SQL injection in crosstab datapoint exportsopenremote · openremote · CWE-89 SQL injection	High7.2	—	0.3%	Oct 30, 2026
28Monitor	GHSA-q5mp-gfjf-cf2jNo exploit	AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) RCE	High7.2	—	—	Oct 30, 2026
32Monitor	GHSA-79wv-8rh2-9vp2No exploit	AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie HeadersCWE-113 Pre-auth	High8.2	—	—	Oct 30, 2026
32Monitor	GHSA-6vfx-w7q3-42gqNo exploit	AdminNeo SQLite Database-List Drop Arbitrary File DeletionCWE-73 Path traversal CSRF	High8.1	—	—	Oct 30, 2026
30Monitor	GHSA-mmq5-xm89-9pfgNo exploit	imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size fieldCWE-400 Pre-auth Denial of service	High7.5	—	—	Oct 30, 2026
30Monitor	GHSA-494m-4556-wf5pNo exploit	imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crashCWE-125 Pre-auth Memory safety Denial of service	High7.5	—	—	Oct 30, 2026
39Monitor	GHSA-hff9-5pqw-6w9fNo exploit	imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionCWE-122 pre-auth RCE Memory safety	Critical9.8	—	—	Oct 30, 2026
39Monitor	GHSA-4xm8-rg9h-jhq2No exploit	Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionCWE-22 pre-auth RCE Path traversal	Critical9.8	—	—	Oct 30, 2026
33Monitor	CVE-2026-63338No exploit	IXP Manager has Broken Object-Level Authorizationinex · ixp-manager · CWE-639 Broken access control (IDOR)	High8.3	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-63339No exploit	IXP Manager has authenticated non-administrator privilege escalationinex · ixp-manager · CWE-20	High8.8	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-63341No exploit	Aedes has Uncaught Exception and Uncontrolled Resource Consumptionmoscajs · aedes · CWE-248 Pre-auth Denial of service	High7.5	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-63344No exploit	Refitter: C# source injection through OpenAPI content-type map keyschristianhelle · refitter · CWE-94 pre-auth RCE	High8.6	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-63345No exploit	Refitter: C# source injection through OpenAPI path keyschristianhelle · refitter · CWE-94 pre-auth RCE	High8.6	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-63346No exploit	Refitter: C# source injection through OpenAPI header parameter nameschristianhelle · refitter · CWE-94 pre-auth RCE	High8.6	—	0.3%	Oct 30, 2026
39Monitor	CVE-2026-63377No exploit	TAKO AI Agent for Okta: Unauthenticated first-run administrator takeoverfctr-id · okta-ai-agent · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-63378No exploit	TAKO AI Agent for Okta: Authenticated Python execution through validator bypassfctr-id · okta-ai-agent · CWE-94 RCE	High8.8	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-63393No exploit	OpenSearch SQL plugin: Unsafe cursor deserialization permits server code executionopensearch-project · sql · CWE-502 RCE Deserialization	High8.7	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-63396No exploit	Coop has a data leak via unauthenticated GraphQL Query.allOrgsroostorg · coop · CWE-306 Pre-auth Auth bypass	High8.7	—	0.3%	Oct 30, 2026
29Monitor	CVE-2026-63398No exploit	Coop has SAML cross-tenant authentication bypassroostorg · coop · CWE-287 Auth bypass	High7.4	—	0.1%	Oct 30, 2026
30Monitor	CVE-2026-63414No exploit	Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsshopify · shopify_app · CWE-863 Broken access control (IDOR)	High7.6	—	0.7%	Oct 30, 2026
37Monitor	CVE-2026-117656No exploit	Unverified Sign in with Apple callback parameter can override verified ID token claimspow-auth · assent · CWE-290 Pre-auth Auth bypass	Critical9.3	—	0.2%	Oct 31, 2026
34Monitor	CVE-2026-110176No exploit	File Force Download for Drupal 7 Access Bypass via Unconditional Download Headersdrupal · file force download · CWE-863 Pre-auth Broken access control (IDOR)	High8.7	—	0.2%	Oct 31, 2026
29Monitor	CVE-2026-116755No exploit	SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fieldssoftiron · hypercloud · CWE-78 RCE Command injection	High7.4	—	0.9%	Oct 31, 2026
28Monitor	CVE-2026-109234No exploit	Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronizationtigroumeow · meow lightbox · CWE-79 pre-auth RCE XSS	High7.2	—	0.3%	Oct 31, 2026
28Monitor	CVE-2026-109997No exploit	Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalizationkstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Oct 31, 2026
28Monitor	CVE-2026-116520No exploit	PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collisionbuildwps · ppwp – password protect pages · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 31, 2026
28Monitor	CVE-2026-118043No exploit	Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversalunknown · bulk media register · CWE-22 Path traversal	High7.2	—	0.2%	Oct 31, 2026
30Monitor	CVE-2026-118185No exploit	Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limitingunknown · security optimizer · CWE-287 Auth bypass	High7.5	—	0.2%	Oct 31, 2026
30Monitor	CVE-2026-118638No exploit	Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Routeunknown · mapster wp maps · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 31, 2026
62This week	CVE-2026-119977Weaponized	WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Executionwordpress · wordpress · CWE-367 pre-auth RCE Race condition	High8.1	KEV	1.1%	Oct 31, 2026
28Monitor	CVE-2026-107653No exploit	SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Commentssurecart · surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 31, 2026
28Monitor	CVE-2026-107750No exploit	PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Notwpovernight · pdf invoices & packing slips for woocommerce · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 31, 2026
39Monitor	CVE-2026-109220No exploit	PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkoaddonsorg · pdf invoice for woocommerce + drag and drop template builder · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.5%	Oct 31, 2026
28Monitor	CVE-2026-111254No exploit	W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiryboldgrid · w3 total cache · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 31, 2026
28Monitor	CVE-2026-115840No exploit	VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parametere4jvikwp · vikrentcar car rental management system · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 31, 2026
28Monitor	CVE-2026-116522No exploit	Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decodecomesio · relevanssi – a better search · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 31, 2026

CVE-2026-62160
34Monitor
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
daptin · daptinOct 30, 2026
CVE-2026-62162
32Monitor
Hydra: Deposit Claim omits Head state-token spending requirement
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
cardano-scaling · hydraOct 30, 2026
CVE-2026-62264
30Monitor
PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
- Info leak
sylphxai · pdf-reader-mcpOct 30, 2026
CVE-2026-62331
32Monitor
praktor: Telegram upload traversal permits persistent agent instruction injection
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
mtzanidakis · praktorOct 30, 2026
CVE-2026-73186
35Monitor
WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
shortpixel · enable media replaceOct 30, 2026
CVE-2026-78527
35Monitor
WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
gs plugins · gs testimonial sliderOct 30, 2026
CVE-2026-90888
39Monitor
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
leadsnap · leadsnapOct 30, 2026
CVE-2026-94175
28Monitor
WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
saad iqbal · all in one loginOct 30, 2026
CVE-2026-115828
37Monitor
Secret Server device validation error
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
delinea · secret serverOct 30, 2026
CVE-2026-115829
39Monitor
Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
CriticalCVSS 9.9No exploitEPSS 0%
- Pre-auth
- Auth bypass
delinea · secret serverOct 30, 2026
CVE-2026-115830
34Monitor
Secret Server JWT issuance error
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
delinea · secret serverOct 30, 2026
CVE-2026-116238
36Monitor
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
pgadmin.org · pgadmin 4Oct 30, 2026
CVE-2026-116239
35Monitor
pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
HighCVSS 8.9No exploitEPSS 0%
- Auth bypass
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116240
28Monitor
pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116241
37Monitor
pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Command injection
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116242
28Monitor
pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
HighCVSS 7.1No exploitEPSS 0%
- Info leak
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116243
30Monitor
pgAdmin 4: Utility binary path can point at a shared storage directory
HighCVSS 7.7No exploitEPSS 0%
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116244
28Monitor
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
HighCVSS 7.1Proof of conceptEPSS 0%
- Hard-coded credentials
- Info leak
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116245
28Monitor
pgAdmin 4: Connection services are not restricted in server mode
HighCVSS 7.1No exploitEPSS 0%
- Info leak
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116246
28Monitor
pgAdmin 4: Server passwords are left in pgAdmin's process environment
HighCVSS 7.0No exploitEPSS 0%
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116247
28Monitor
pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
HighCVSS 7.1No exploitEPSS 0%
- Info leak
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-116249
28Monitor
pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
pgadmin.org · pgadmin 4Oct 30, 2026
CVE-2026-116250
29Monitor
pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
HighCVSS 7.3No exploitEPSS 0%
- Open redirect
pgadmin.org · pgadmin 4Oct 30, 2026
CVE-2026-116252
28Monitor
pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
HighCVSS 7.1No exploitEPSS 0%
pgadmin · pgadmin 4Oct 30, 2026
CVE-2026-119331
28Monitor
Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Info leak
ladybirdbrowser · ladybirdOct 30, 2026
CVE-2026-119332
35Monitor
Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
ladybirdbrowser · ladybirdOct 30, 2026
CVE-2026-119333
31Monitor
draw.io Desktop allows Windows executable search-path hijacking
HighCVSS 7.8No exploitEPSS 0%
jgraph · drawio-desktopOct 30, 2026
CVE-2026-119335
31Monitor
Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
pi-hole · pi-holeOct 30, 2026
CVE-2026-119336
31Monitor
Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink
HighCVSS 7.8No exploitEPSS 0%
pi-hole · pi-holeOct 30, 2026
CVE-2026-119337
28Monitor
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
infiniflow · ragflowOct 30, 2026
CVE-2026-55598
36Monitor
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
CriticalCVSS 9.1No exploitEPSS 0%
- SSRF
madeofpendletonwool · pinepodsOct 30, 2026
CVE-2026-61620
39Monitor
HoneySQL unchecked entity names can lead to SQL injection results
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
seancorfield · honeysqlOct 30, 2026
CVE-2026-61850
37Monitor
Kargo: Privilege escalation via Project RBAC management in the Kargo API
CriticalCVSS 9.3No exploitEPSS 0%
akuity · kargoOct 30, 2026
CVE-2026-62284
34Monitor
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
HighCVSS 8.6No exploitEPSS 0%
- RCE
- SSRF
osac-project · osac-operatorOct 30, 2026
CVE-2026-62301
28Monitor
MyTube: Visitor Can Access Hidden Video Metadata and Content
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
franklioxygen · mytubeOct 30, 2026
CVE-2026-62302
34Monitor
MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
franklioxygen · mytubeOct 30, 2026
CVE-2026-62333
34Monitor
OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
openvm-org · openvmOct 30, 2026
CVE-2026-62334
34Monitor
OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
openvm-org · openvmOct 30, 2026
CVE-2026-78402
29Monitor
Stack Buffer Overflow in Sentinel Keys Server
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
- Memory safety
thalesgroup · sentinel keys serverOct 30, 2026
CVE-2026-78403
37Monitor
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
thalesgroup · sentinel keys serverOct 30, 2026
CVE-2026-117666
36Monitor
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
deadtrickster · ssl_verify_funOct 30, 2026
CVE-2026-40573
34Monitor
NovumOS: Nova Interpreter Privilege Escalation
HighCVSS 8.6No exploitEPSS 0%
- Local privilege escalation
minecanton209 · novumosOct 30, 2026
CVE-2026-58412
32Monitor
Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
filecoin-project · filecoin-pinOct 30, 2026
CVE-2026-62297
30Monitor
ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
agamnentzar · ag-psdOct 30, 2026
CVE-2026-62847
32Monitor
Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)
HighCVSS 8.2No exploitEPSS 0%
- Local privilege escalation
metalama · metalamaOct 30, 2026
CVE-2026-62848
29Monitor
Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
HighCVSS 7.3No exploitEPSS 0%
- Deserialization
metalama · metalamaOct 30, 2026
CVE-2026-62849
36Monitor
ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
mqttsnet · thinglinksOct 30, 2026
CVE-2026-62853
39Monitor
ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Command injection
mqttsnet · thinglinksOct 30, 2026
CVE-2026-62863
38Monitor
MoLing: unauthenticated SSE and wildcard CORS expose tool sessions
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
gojue · molingOct 30, 2026
CVE-2026-62864
30Monitor
Ring's nested-params middleware has inefficient regular expression complexity
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ring-clojure · ringOct 30, 2026
CVE-2026-62958
31Monitor
libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
HighCVSS 7.9Proof of conceptEPSS 0%
libriscv · libriscvOct 30, 2026
CVE-2026-62965
28Monitor
SABnzbd: Orphan-job path traversal permits arbitrary file deletion
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
sabnzbd · sabnzbdOct 30, 2026
CVE-2026-62966
30Monitor
ESPAsyncWebServer multipart parser has null-pointer write
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
esp32async · espasyncwebserverOct 30, 2026
CVE-2026-62967
32Monitor
ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
sinamics · ztnetOct 30, 2026
CVE-2026-62968
34Monitor
Dream Displays has command-line argument injection in yt-dlp invocation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
arsmotorin · dreamdisplaysOct 30, 2026
CVE-2026-62979
33Monitor
jack: upstream error responses expose backend and peer credentials
HighCVSS 8.4No exploitEPSS 0%
- Info leak
roziscoding · jackOct 30, 2026
CVE-2026-62989
32Monitor
Shopper: missing variant-delete authorization permits destructive single and bulk actions
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
shopperlabs · shopperOct 30, 2026
CVE-2026-62990
34Monitor
Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
HighCVSS 8.7No exploitEPSS 0%
- XSS
shopperlabs · shopperOct 30, 2026
CVE-2026-111578
30Monitor
PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · pdf invoices & packing slips for woocommerceOct 30, 2026
CVE-2026-118938
35Monitor
Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Deserialization
trailofbits · ficklingOct 30, 2026
CVE-2026-16760
35Monitor
Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Deserialization
trailofbits · ficklingOct 30, 2026
CVE-2026-63182
32Monitor
LightSAML: Signature reference wrapping permits unsigned assertion claims
HighCVSS 8.1No exploitEPSS 0%
- Deserialization
- Weak crypto
litesaml · lightsamlOct 30, 2026
CVE-2026-63184
28Monitor
Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SSRF
christianhelle · refitterOct 30, 2026
CVE-2026-63201
28Monitor
netopeer2-server logging has format string vulnerability via subtree filter
HighCVSS 7.1No exploitEPSS 0%
cesnet · netopeer2Oct 30, 2026
CVE-2026-63224
28Monitor
OpenRemote has authenticated SQL injection in crosstab datapoint exports
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
openremote · openremoteOct 30, 2026
GHSA-q5mp-gfjf-cf2j
28Monitor
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
HighCVSS 7.2No exploit
- RCE
Oct 30, 2026
GHSA-79wv-8rh2-9vp2
32Monitor
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
HighCVSS 8.2No exploit
- Pre-auth
Oct 30, 2026
GHSA-6vfx-w7q3-42gq
32Monitor
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
HighCVSS 8.1No exploit
- Path traversal
- CSRF
Oct 30, 2026
GHSA-mmq5-xm89-9pfg
30Monitor
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 30, 2026
GHSA-494m-4556-wf5p
30Monitor
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash
HighCVSS 7.5No exploit
- Pre-auth
- Memory safety
- Denial of service
Oct 30, 2026
GHSA-hff9-5pqw-6w9f
39Monitor
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution
CriticalCVSS 9.8No exploit
- pre-auth RCE
- Memory safety
Oct 30, 2026
GHSA-4xm8-rg9h-jhq2
39Monitor
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
CriticalCVSS 9.8No exploit
- pre-auth RCE
- Path traversal
Oct 30, 2026
CVE-2026-63338
33Monitor
IXP Manager has Broken Object-Level Authorization
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
inex · ixp-managerOct 30, 2026
CVE-2026-63339
35Monitor
IXP Manager has authenticated non-administrator privilege escalation
HighCVSS 8.8No exploitEPSS 0%
inex · ixp-managerOct 30, 2026
CVE-2026-63341
30Monitor
Aedes has Uncaught Exception and Uncontrolled Resource Consumption
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
moscajs · aedesOct 30, 2026
CVE-2026-63344
34Monitor
Refitter: C# source injection through OpenAPI content-type map keys
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
christianhelle · refitterOct 30, 2026
CVE-2026-63345
34Monitor
Refitter: C# source injection through OpenAPI path keys
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
christianhelle · refitterOct 30, 2026
CVE-2026-63346
34Monitor
Refitter: C# source injection through OpenAPI header parameter names
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
christianhelle · refitterOct 30, 2026
CVE-2026-63377
39Monitor
TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
fctr-id · okta-ai-agentOct 30, 2026
CVE-2026-63378
35Monitor
TAKO AI Agent for Okta: Authenticated Python execution through validator bypass
HighCVSS 8.8No exploitEPSS 0%
- RCE
fctr-id · okta-ai-agentOct 30, 2026
CVE-2026-63393
34Monitor
OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Deserialization
opensearch-project · sqlOct 30, 2026
CVE-2026-63396
34Monitor
Coop has a data leak via unauthenticated GraphQL Query.allOrgs
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
roostorg · coopOct 30, 2026
CVE-2026-63398
29Monitor
Coop has SAML cross-tenant authentication bypass
HighCVSS 7.4No exploitEPSS 0%
- Auth bypass
roostorg · coopOct 30, 2026
CVE-2026-63414
30Monitor
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
shopify · shopify_appOct 30, 2026
CVE-2026-117656
37Monitor
Unverified Sign in with Apple callback parameter can override verified ID token claims
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
pow-auth · assentOct 31, 2026
CVE-2026-110176
34Monitor
File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
drupal · file force downloadOct 31, 2026
CVE-2026-116755
29Monitor
SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields
HighCVSS 7.4No exploitEPSS 0%
- RCE
- Command injection
softiron · hypercloudOct 31, 2026
CVE-2026-109234
28Monitor
Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
HighCVSS 7.2No exploitEPSS 0%
- pre-auth RCE
- XSS
tigroumeow · meow lightboxOct 31, 2026
CVE-2026-109997
28Monitor
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderOct 31, 2026
CVE-2026-116520
28Monitor
PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
buildwps · ppwp – password protect pagesOct 31, 2026
CVE-2026-118043
28Monitor
Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
unknown · bulk media registerOct 31, 2026
CVE-2026-118185
30Monitor
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · security optimizerOct 31, 2026
CVE-2026-118638
30Monitor
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · mapster wp mapsOct 31, 2026
CVE-2026-119977
62This week
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
HighCVSS 8.1KEVWeaponizedEPSS 1%
- pre-auth RCE
- Race condition
wordpress · wordpressOct 31, 2026
CVE-2026-107653
28Monitor
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
surecart · surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & paymentsOct 31, 2026
CVE-2026-107750
28Monitor
PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Not
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpovernight · pdf invoices & packing slips for woocommerceOct 31, 2026
CVE-2026-109220
39Monitor
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checko
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
addonsorg · pdf invoice for woocommerce + drag and drop template builderOct 31, 2026
CVE-2026-111254
28Monitor
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
boldgrid · w3 total cacheOct 31, 2026
CVE-2026-115840
28Monitor
VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
e4jvikwp · vikrentcar car rental management systemOct 31, 2026
CVE-2026-116522
28Monitor
Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
comesio · relevanssi – a better searchOct 31, 2026