By publication date

Exploited and new serious CVEs: October 2026

8,746 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 9 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-39784No exploit	WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilitynicdark · hotel booking · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 6, 2026
37Monitor	CVE-2026-39785No exploit	WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerabilityserhii pasyuk · gmedia photo gallery · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-39790No exploit	WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikrentcar · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 6, 2026
34Monitor	CVE-2026-39792No exploit	WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerabilitymitchell bennis · simple file list · CWE-22 Pre-auth Path traversal Denial of service	High8.6	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-39793No exploit	WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerabilitynicu micle · simple jwt login · CWE-288 Auth bypass	High8.8	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-39794No exploit	WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerabilitywc lovers · woocommerce multivendor marketplace – rest api · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 6, 2026
37Monitor	CVE-2026-39795No exploit	WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerabilitybrewlabs · sendpress newsletters · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-39796No exploit	WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerabilityflipper code – wordpress development company · advanced posts listing – show post list easily · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 6, 2026
39Monitor	CVE-2026-39797No exploit	WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerabilitydata443 risk mitigation, inc. · gdpr framework by data443 · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-40806No exploit	WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityplugin devs · blog, posts and category filter for elementor · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-40807No exploit	WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerabilityaman · cf7 views – complete entry management for contact form 7 · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 6, 2026
37Monitor	CVE-2026-41555No exploit	WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerabilityweblizar – wordpress themes & plugin · newsletter subscription form – user subscriptions form, capture email · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-41559No exploit	WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerabilitypluginjoy · safesnap – verified wordpress backup & restore · CWE-201 Pre-auth	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-41560No exploit	WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerabilitywxdlabs · wxd backup lite · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-41561No exploit	WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerabilityadrian lin · museder restoreone · CWE-201 Pre-auth	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-41562No exploit	WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilitynorvisgabriel · norvis backup · CWE-201 Pre-auth	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-42413No exploit	WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerabilitydaftplug · snapshotify – all-in-one backup & restore & migrate · CWE-201 Pre-auth	High7.5	—	0.3%	Oct 6, 2026
34Monitor	CVE-2026-42414No exploit	WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerabilitycridiostudio · listingpro · CWE-89 SQL injection	High8.5	—	0.2%	Oct 6, 2026
37Monitor	CVE-2026-42415No exploit	WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerabilityp-themes · porto theme - functionality · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 6, 2026
34Monitor	CVE-2026-42416No exploit	WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerabilityandondesign · udesign core · CWE-89 SQL injection	High8.5	—	0.2%	Oct 6, 2026
37Monitor	CVE-2026-42417No exploit	WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerabilityreputeinfosystems · armember premium · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-42418No exploit	WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilitysocialrocket · social rocket · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-42634No exploit	WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilitybplugins · video background block – use video as background in the section. · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-42635No exploit	WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerabilitywpgenie · woocommerce simple auctions · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-42636No exploit	WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerabilitywp legal pages · wp cookie notice for gdpr, ccpa & eprivacy consent · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-42638No exploit	WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerabilitysyed balkhi · easy digital downloads · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-48197No exploit	WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerabilitypublishpress · publishpress capabilities · CWE-266	High7.2	—	0.4%	Oct 6, 2026
30Monitor	CVE-2026-48199No exploit	WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerabilitybeplusthemes · sermon'e · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 6, 2026
31Monitor	CVE-2026-4889No exploit	SQL Injection (SQLi) in eLoanApp Platform by RDL Technologiesrdl technologies · eloanapp platform · CWE-89 Pre-auth SQL injection	High7.8	—	0.2%	Oct 6, 2026
35Monitor	CVE-2026-62072No exploit	WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerabilityprogress planner · progress planner · CWE-862 Broken access control (IDOR)	High8.8	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-94675No exploit	WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerabilityfluent forms free vs pro · fluent forms pro add on pack · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 6, 2026
32Monitor	CVE-2026-95105No exploit	Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flippingdanielberkompas · cloak · CWE-649 Pre-auth SQL injection	High8.2	—	0.1%	Oct 6, 2026
29Monitor	CVE-2026-95526No exploit	WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerabilityrealmag777 · bear · CWE-862 Pre-auth Broken access control (IDOR)	High7.3	—	0.2%	Oct 6, 2026
32Monitor	CVE-2026-95594No exploit	WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerabilitycozy vision technologies pvt. ltd. · sms alert order notifications · CWE-266 Pre-auth	High8.1	—	0.2%	Oct 6, 2026
31Monitor	CVE-2026-98166No exploit	drm/ttm: fix swapped-out resources never leaving their bulk_move rangelinux · linux	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98169No exploit	smb: client: fix potential OOB read in smb3_enum_snapshots()linux · linux Pre-auth	High7.1	—	0.4%	Oct 6, 2026
35Monitor	CVE-2026-98171No exploit	smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUslinux · linux Pre-auth	High8.8	—	0.5%	Oct 6, 2026
30Monitor	CVE-2026-98173No exploit	smb: client: fix use-after-free of iface in cifs_try_adding_channels()linux · linux Pre-auth	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-98174No exploit	smb: client: fix rlist race and missing initializationlinux · linux Pre-auth	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-98175No exploit	smb: client: cancel reconnect work in clean_demultiplex_info()linux · linux Pre-auth	High7.5	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-98180Proof of concept	drm/msm: RCU-free the scheduler-containing ring and VM objectslinux · linux Local privilege escalation	High7.1	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98197No exploit	hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on removelinux · linux	High7.0	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98216No exploit	IB/hfi1: Fix the PIO_CRED credit-return mmaplinux · linux	High7.1	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98228No exploit	mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQlinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98229No exploit	xfrm: save input state data before secpath resetslinux · linux	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98230No exploit	xfrm: use hlist_del_init_rcu for state_cache and state_cache_inputlinux · linux	High7.0	—	0.1%	Oct 6, 2026
32Monitor	CVE-2026-98239No exploit	net: lan743x: fix RX checksum use-after-freelinux · linux Pre-auth	High8.1	—	0.4%	Oct 6, 2026
31Monitor	CVE-2026-98241No exploit	ipv6: xfrm: use full sockets in local error pathslinux · linux	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98243No exploit	dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3linux · linux	High7.1	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98251No exploit	openvswitch: avoid reallocating confirmed conntrack labelslinux · linux	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98252No exploit	RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()linux · linux	High7.0	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98253No exploit	RDMA/ucma: Serialize join and leave on copy_to_user failurelinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98254No exploit	swiotlb: use the adjusted address for the highmem page lookuplinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98256Proof of concept	signal: Prevent exec() racelinux · linux	High7.8	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-98257No exploit	rds: ib: use rds_conn_drop() on protocol version mismatchlinux · linux Pre-auth Denial of service	High7.5	—	0.5%	Oct 6, 2026
31Monitor	CVE-2026-98258Proof of concept	posix-cpu-timers: Prevent freeing a timer which is queued on the expiry listlinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98260Proof of concept	exec: Cleanup POSIX timers right after de_thread()linux · linux	High7.8	—	0.1%	Oct 6, 2026
32Monitor	CVE-2026-98261No exploit	cifs: Fix server use-after-free in cifs_chan_skip_or_disable()linux · linux Pre-auth	High8.1	—	0.4%	Oct 6, 2026
31Monitor	CVE-2026-98276No exploit	net: lock the socket in sock_gettstamp()linux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98281No exploit	futex: Also allocate private hash on vfork()linux · linux	High7.8	—	0.1%	Oct 6, 2026
35Monitor	CVE-2026-98282No exploit	powerpc/iommu: Fix the overflow validation in iommu_tce_check_iobalinux · linux	High8.8	—	0.1%	Oct 6, 2026
35Monitor	CVE-2026-98283No exploit	KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()linux · linux	High8.8	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-98290No exploit	Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanuplinux · linux Pre-auth	High7.5	—	0.2%	Oct 6, 2026
31Monitor	CVE-2026-98305No exploit	net: dsa: mxl862xx: disable the stats poll on teardownlinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98311No exploit	wifi: virt_wifi: don't transfer operstate before registerlinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98315No exploit	ntfs: protect runlist updates with the runlist locklinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98318No exploit	smb: client: validate absolute native symlink targets before NT fixupslinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98320No exploit	netfilter: flowtable: hold reference on ct until flow is releasedlinux · linux	High7.8	—	0.1%	Oct 6, 2026
39Monitor	CVE-2026-98323No exploit	RDMA/siw: Bound fragmented header copies by the remaining lengthlinux · linux Pre-auth	Critical9.8	—	0.5%	Oct 6, 2026
31Monitor	CVE-2026-98324No exploit	dmaengine: pxa: fix double counting of the hw descriptorslinux · linux	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98330No exploit	wifi: cfg80211: get the wiphy out of a dying network namespacelinux · linux	High7.0	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98331No exploit	wifi: mac80211: unlist vifs when their netdev is unregisteredlinux · linux	High7.0	—	0.1%	Oct 6, 2026
35Monitor	CVE-2026-98339No exploit	wifi: cfg80211: don't filter by BSS type when removing stale entrieslinux · linux Pre-auth	High8.8	—	0.2%	Oct 6, 2026
31Monitor	CVE-2026-98341No exploit	wifi: cfg80211: don't free driver-owned scan requestslinux · linux	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98348No exploit	wifi: libipw: reject too-short association responseslinux · linux Pre-auth	High7.1	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-98349No exploit	wifi: libipw: reject too-short beacon and probe responseslinux · linux Pre-auth	High7.1	—	0.2%	Oct 6, 2026
32Monitor	CVE-2026-98357No exploit	IB/isert: wait for deferred control PDU completions before releasing the connectionlinux · linux Pre-auth	High8.1	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-98359No exploit	RDMA/core: Reject unregistering netdevs in ib_get_eth_speedlinux · linux	High7.0	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-98360No exploit	RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeedslinux · linux	High7.0	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98361No exploit	RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write pathslinux · linux Local privilege escalation	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98364No exploit	xfrm: hold net_device reference under RCU in bundle creationlinux · linux	High7.8	—	0.1%	Oct 6, 2026
39Monitor	CVE-2026-98365No exploit	RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB accesslinux · linux Pre-auth	Critical9.8	—	0.3%	Oct 6, 2026
31Monitor	CVE-2026-98366No exploit	RDMA/rxe: validate access flags before swapping the MR's PDlinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98367No exploit	RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_acceptlinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98368No exploit	esp: downgrade zerocopy managed frags before mutating skb fragslinux · linux	High7.8	—	0.1%	Oct 6, 2026
31Monitor	CVE-2026-98369No exploit	xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()linux · linux	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-84854No exploit	Out of Bound Write on WibuKey for Windowswibu-systems-ag · wibukey · CWE-787 Memory safety	High7.0	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-103831No exploit	Insecure deserialization in the TrueLayer Magento 2 plugintruelayer · truelayer magento 2 plugin · CWE-502 RCE Deserialization	High7.5	—	0.1%	Oct 6, 2026
34Monitor	CVE-2026-105985No exploit	Authenticated RCE via render-components Entry Type overridescraftcms · cms · CWE-1336 RCE SSTI	High8.7	—	0.6%	Oct 6, 2026
28Monitor	CVE-2026-105834No exploit	Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Sourcerundeck · rundeck · CWE-22 Path traversal	High7.1	—	0.3%	Oct 6, 2026
36Monitor	CVE-2026-105835No exploit	PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpointplanka · planka · CWE-307 Pre-auth	Critical9.1	—	0.3%	Oct 6, 2026
39Monitor	CVE-2026-106016No exploit	Mitigation bypass in the File Handling componentmozilla · firefox · CWE-693 Pre-auth	Critical9.8	—	0.3%	Oct 6, 2026
36Monitor	CVE-2026-82531Proof of concept	Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cachesmarty-php · smarty · CWE-94 pre-auth RCE	Critical9.2	—	0.8%	Oct 6, 2026
35Monitor	CVE-2026-105788No exploit	Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_appmicrosoft · ufo · CWE-78 RCE Command injection	High8.8	—	1.0%	Oct 6, 2026
34Monitor	CVE-2026-105837No exploit	libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflowsezero · libmikmod · CWE-190 Memory safety	High8.5	—	0.1%	Oct 6, 2026
34Monitor	CVE-2026-105839No exploit	libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBODsezero · libmikmod · CWE-190 Memory safety	High8.5	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-105840No exploit	lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()uwe ohse · lrzsz · CWE-22 Pre-auth Path traversal	High7.7	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-105841No exploit	lrzsz before 0.13.0 OS Command Injection via lrz Pipe Modeuwe ohse · lrzsz · CWE-78 pre-auth RCE Command injection	High7.7	—	0.9%	Oct 6, 2026
37Monitor	CVE-2026-106037No exploit	Mooncake through 0.3.13.post1 Missing Authentication in Store REST Servicekvcache-ai · mooncake · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.7%	Oct 6, 2026
35Monitor	CVE-2026-106038No exploit	Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCskvcache-ai · mooncake · CWE-306 Pre-auth Auth bypass	High8.8	—	0.4%	Oct 6, 2026

CVE-2026-39784
28Monitor
WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nicdark · hotel bookingOct 6, 2026
CVE-2026-39785
37Monitor
WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
serhii pasyuk · gmedia photo galleryOct 6, 2026
CVE-2026-39790
28Monitor
WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
e4jvikwp · vikrentcarOct 6, 2026
CVE-2026-39792
34Monitor
WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
mitchell bennis · simple file listOct 6, 2026
CVE-2026-39793
35Monitor
WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
nicu micle · simple jwt loginOct 6, 2026
CVE-2026-39794
30Monitor
WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wc lovers · woocommerce multivendor marketplace – rest apiOct 6, 2026
CVE-2026-39795
37Monitor
WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
brewlabs · sendpress newslettersOct 6, 2026
CVE-2026-39796
30Monitor
WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
flipper code – wordpress development company · advanced posts listing – show post list easilyOct 6, 2026
CVE-2026-39797
39Monitor
WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
data443 risk mitigation, inc. · gdpr framework by data443Oct 6, 2026
CVE-2026-40806
28Monitor
WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
plugin devs · blog, posts and category filter for elementorOct 6, 2026
CVE-2026-40807
28Monitor
WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
aman · cf7 views – complete entry management for contact form 7Oct 6, 2026
CVE-2026-41555
37Monitor
WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
weblizar – wordpress themes & plugin · newsletter subscription form – user subscriptions form, capture emailOct 6, 2026
CVE-2026-41559
30Monitor
WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
pluginjoy · safesnap – verified wordpress backup & restoreOct 6, 2026
CVE-2026-41560
30Monitor
WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wxdlabs · wxd backup liteOct 6, 2026
CVE-2026-41561
30Monitor
WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
adrian lin · museder restoreoneOct 6, 2026
CVE-2026-41562
30Monitor
WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
norvisgabriel · norvis backupOct 6, 2026
CVE-2026-42413
30Monitor
WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
daftplug · snapshotify – all-in-one backup & restore & migrateOct 6, 2026
CVE-2026-42414
34Monitor
WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
cridiostudio · listingproOct 6, 2026
CVE-2026-42415
37Monitor
WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
p-themes · porto theme - functionalityOct 6, 2026
CVE-2026-42416
34Monitor
WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
andondesign · udesign coreOct 6, 2026
CVE-2026-42417
37Monitor
WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
reputeinfosystems · armember premiumOct 6, 2026
CVE-2026-42418
28Monitor
WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
socialrocket · social rocketOct 6, 2026
CVE-2026-42634
28Monitor
WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bplugins · video background block – use video as background in the section.Oct 6, 2026
CVE-2026-42635
28Monitor
WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wpgenie · woocommerce simple auctionsOct 6, 2026
CVE-2026-42636
28Monitor
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp legal pages · wp cookie notice for gdpr, ccpa & eprivacy consentOct 6, 2026
CVE-2026-42638
30Monitor
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
syed balkhi · easy digital downloadsOct 6, 2026
CVE-2026-48197
28Monitor
WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
HighCVSS 7.2No exploitEPSS 0%
publishpress · publishpress capabilitiesOct 6, 2026
CVE-2026-48199
30Monitor
WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
beplusthemes · sermon'eOct 6, 2026
CVE-2026-4889
31Monitor
SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
- SQL injection
rdl technologies · eloanapp platformOct 6, 2026
CVE-2026-62072
35Monitor
WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
progress planner · progress plannerOct 6, 2026
CVE-2026-94675
28Monitor
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
fluent forms free vs pro · fluent forms pro add on packOct 6, 2026
CVE-2026-95105
32Monitor
Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SQL injection
danielberkompas · cloakOct 6, 2026
CVE-2026-95526
29Monitor
WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
realmag777 · bearOct 6, 2026
CVE-2026-95594
32Monitor
WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
cozy vision technologies pvt. ltd. · sms alert order notificationsOct 6, 2026
CVE-2026-98166
31Monitor
drm/ttm: fix swapped-out resources never leaving their bulk_move range
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98169
28Monitor
smb: client: fix potential OOB read in smb3_enum_snapshots()
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98171
35Monitor
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98173
30Monitor
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98174
30Monitor
smb: client: fix rlist race and missing initialization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98175
30Monitor
smb: client: cancel reconnect work in clean_demultiplex_info()
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98180
28Monitor
drm/msm: RCU-free the scheduler-containing ring and VM objects
HighCVSS 7.1Proof of conceptEPSS 0%
- Local privilege escalation
linux · linuxOct 6, 2026
CVE-2026-98197
28Monitor
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98216
28Monitor
IB/hfi1: Fix the PIO_CRED credit-return mmap
HighCVSS 7.1No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98228
31Monitor
mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98229
31Monitor
xfrm: save input state data before secpath resets
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98230
28Monitor
xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98239
32Monitor
net: lan743x: fix RX checksum use-after-free
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98241
31Monitor
ipv6: xfrm: use full sockets in local error paths
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98243
28Monitor
dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3
HighCVSS 7.1No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98251
31Monitor
openvswitch: avoid reallocating confirmed conntrack labels
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98252
28Monitor
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98253
31Monitor
RDMA/ucma: Serialize join and leave on copy_to_user failure
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98254
31Monitor
swiotlb: use the adjusted address for the highmem page lookup
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98256
31Monitor
signal: Prevent exec() race
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98257
30Monitor
rds: ib: use rds_conn_drop() on protocol version mismatch
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxOct 6, 2026
CVE-2026-98258
31Monitor
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98260
31Monitor
exec: Cleanup POSIX timers right after de_thread()
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98261
32Monitor
cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98276
31Monitor
net: lock the socket in sock_gettstamp()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98281
31Monitor
futex: Also allocate private hash on vfork()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98282
35Monitor
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98283
35Monitor
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
HighCVSS 8.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98290
30Monitor
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98305
31Monitor
net: dsa: mxl862xx: disable the stats poll on teardown
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98311
31Monitor
wifi: virt_wifi: don't transfer operstate before register
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98315
31Monitor
ntfs: protect runlist updates with the runlist lock
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98318
31Monitor
smb: client: validate absolute native symlink targets before NT fixups
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98320
31Monitor
netfilter: flowtable: hold reference on ct until flow is released
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98323
39Monitor
RDMA/siw: Bound fragmented header copies by the remaining length
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98324
31Monitor
dmaengine: pxa: fix double counting of the hw descriptors
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98330
28Monitor
wifi: cfg80211: get the wiphy out of a dying network namespace
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98331
28Monitor
wifi: mac80211: unlist vifs when their netdev is unregistered
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98339
35Monitor
wifi: cfg80211: don't filter by BSS type when removing stale entries
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98341
31Monitor
wifi: cfg80211: don't free driver-owned scan requests
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98348
28Monitor
wifi: libipw: reject too-short association responses
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98349
28Monitor
wifi: libipw: reject too-short beacon and probe responses
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98357
32Monitor
IB/isert: wait for deferred control PDU completions before releasing the connection
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98359
28Monitor
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98360
28Monitor
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
HighCVSS 7.0No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98361
31Monitor
RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxOct 6, 2026
CVE-2026-98364
31Monitor
xfrm: hold net_device reference under RCU in bundle creation
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98365
39Monitor
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxOct 6, 2026
CVE-2026-98366
31Monitor
RDMA/rxe: validate access flags before swapping the MR's PD
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98367
31Monitor
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98368
31Monitor
esp: downgrade zerocopy managed frags before mutating skb frags
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-98369
31Monitor
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 6, 2026
CVE-2026-84854
28Monitor
Out of Bound Write on WibuKey for Windows
HighCVSS 7.0No exploitEPSS 0%
- Memory safety
wibu-systems-ag · wibukeyOct 6, 2026
CVE-2026-103831
30Monitor
Insecure deserialization in the TrueLayer Magento 2 plugin
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Deserialization
truelayer · truelayer magento 2 pluginOct 6, 2026
CVE-2026-105985
34Monitor
Authenticated RCE via render-components Entry Type overrides
HighCVSS 8.7No exploitEPSS 0%
- RCE
- SSTI
craftcms · cmsOct 6, 2026
CVE-2026-105834
28Monitor
Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
rundeck · rundeckOct 6, 2026
CVE-2026-105835
36Monitor
PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
planka · plankaOct 6, 2026
CVE-2026-106016
39Monitor
Mitigation bypass in the File Handling component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxOct 6, 2026
CVE-2026-82531
36Monitor
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
CriticalCVSS 9.2Proof of conceptEPSS 0%
- pre-auth RCE
smarty-php · smartyOct 6, 2026
CVE-2026-105788
35Monitor
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
microsoft · ufoOct 6, 2026
CVE-2026-105837
34Monitor
libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
sezero · libmikmodOct 6, 2026
CVE-2026-105839
34Monitor
libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
sezero · libmikmodOct 6, 2026
CVE-2026-105840
30Monitor
lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Path traversal
uwe ohse · lrzszOct 6, 2026
CVE-2026-105841
30Monitor
lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Command injection
uwe ohse · lrzszOct 6, 2026
CVE-2026-106037
37Monitor
Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
kvcache-ai · mooncakeOct 6, 2026
CVE-2026-106038
35Monitor
Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
kvcache-ai · mooncakeOct 6, 2026