By publication date

Exploited and new serious CVEs: November 2026

3,959 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 14 of 40

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-124027No exploit	ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePagezhimaai · chatwiki · CWE-306 Pre-auth Auth bypass	High8.7	—	0.4%	6 days ago
36Monitor	CVE-2026-124040Proof of concept	CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header Statecivetweb · civetweb · CWE-416 Pre-auth Memory safety	Critical9.2	—	0.5%	6 days ago
35Monitor	CVE-2026-33050Proof of concept	GeoNode: OS command injection via uploaded file layer namegeonode · geonode · CWE-78 RCE Command injection	High8.8	—	0.6%	6 days ago
39Monitor	CVE-2026-58490No exploit	Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaultstracecathq · tracecat · CWE-347 Pre-auth Weak crypto	Critical9.8	—	0.3%	6 days ago
35Monitor	CVE-2026-65960No exploit	Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork podscilium · tetragon · CWE-306 Auth bypass Local privilege escalation	High8.8	—	0.1%	6 days ago
32Monitor	CVE-2026-102344No exploit	Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local serverkunchenguid · lavish-axi · CWE-73 Pre-auth Path traversal	High8.1	—	0.1%	6 days ago
37Monitor	CVE-2026-102530No exploit	JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URLjupyterlab · jupyterlab-desktop · CWE-79 pre-auth RCE XSS	Critical9.4	—	0.4%	6 days ago
30Monitor	CVE-2026-102657No exploit	esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalesm-dev · esm.sh · CWE-22 Pre-auth Path traversal	High7.5	—	0.7%	6 days ago
34Monitor	CVE-2026-124078No exploit	plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parsertootallnate · plist.js · CWE-674 Pre-auth Denial of service	High8.7	—	0.3%	6 days ago
39Monitor	CVE-2026-54349No exploit	Chartbrew SQL injection in dashboard filter substitutionchartbrew · chartbrew · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.4%	6 days ago
28Monitor	CVE-2026-54589No exploit	Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)chartbrew · chartbrew · CWE-918 SSRF	High7.0	—	0.3%	6 days ago
39Monitor	CVE-2026-63438No exploit	2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Valuebubka · 2fauth · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	6 days ago
39Monitor	CVE-2026-63439No exploit	2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verificationbubka · 2fauth · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	6 days ago
32Monitor	CVE-2026-71397No exploit	Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_serverelixir-grpc · grpc_server · CWE-770 Pre-auth Denial of service	High8.2	—	0.3%	6 days ago
39Monitor	CVE-2026-85295No exploit	Chartbrew: Full account takeover via JWTs accepted under default CB_SECRETchartbrew · chartbrew · CWE-1394 Pre-auth	Critical9.8	—	0.3%	6 days ago
30Monitor	CVE-2026-85708No exploit	Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokenschartbrew · chartbrew · CWE-347 Pre-auth Weak crypto	High7.5	—	0.1%	6 days ago
35Monitor	CVE-2026-85712No exploit	Chartbrew: Cross-tenant project takeover via body.team_id in /project routeschartbrew · chartbrew · CWE-639 Broken access control (IDOR)	High8.8	—	0.3%	6 days ago
30Monitor	CVE-2026-85726No exploit	Chartbrew: Blind NoSQL injection via date variable in embedded chartchartbrew · chartbrew · CWE-943 Pre-auth SQL injection	High7.5	—	0.3%	6 days ago
32Monitor	CVE-2026-85736No exploit	Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH pathschartbrew · chartbrew · CWE-73 Path traversal	High8.1	—	0.2%	6 days ago
37Monitor	CVE-2026-86005No exploit	Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrewchartbrew · chartbrew · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.4%	6 days ago
38Monitor	CVE-2026-86044No exploit	JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Executionjupyterlab · jupyterlab-desktop · CWE-601 pre-auth RCE Open redirect	Critical9.6	—	0.3%	6 days ago
35Monitor	CVE-2026-50240No exploit	Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipred hat · builds for red hat openshift · CWE-862 Broken access control (IDOR)	High8.8	—	0.4%	6 days ago
37Monitor	CVE-2026-59104No exploit	UgCS server HCI authentication bypass with empty credentialssph engineering · ugcs · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.6%	6 days ago
30Monitor	CVE-2026-68933No exploit	Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storagechartbrew · chartbrew · CWE-307 Pre-auth	High7.5	—	0.1%	6 days ago
36Monitor	CVE-2026-68935No exploit	Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connectionschartbrew · chartbrew · CWE-918 SSRF	Critical9.1	—	0.5%	6 days ago
40Plan	CVE-2026-109469No exploit	Entra Device Registration Elevation of Privilege Vulnerabilitymicrosoft · entra device registration · CWE-639 Pre-auth Broken access control (IDOR)	Critical10.0	—	0.6%	6 days ago
35Monitor	CVE-2026-104913No exploit	Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.jsonesaia · interactive real estate – floor plan & building visualizer · CWE-434 RCE File upload	High8.8	—	0.5%	6 days ago
28Monitor	CVE-2026-119070No exploit	Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replaceroptimole · optimole – optimize images \| convert webp & avif \| cdn & lazy load \| image optimization · CWE-79 Pre-auth XSS	High7.2	—	0.2%	6 days ago
28Monitor	CVE-2026-119175No exploit	Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Contentgijo · flying images: optimize and lazy load images for faster page speed · CWE-79 Pre-auth XSS	High7.2	—	0.3%	6 days ago
28Monitor	CVE-2026-120082No exploit	GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_contentpaoltaia · geodirectory – wp business directory plugin and classified listings directory · CWE-79 Pre-auth XSS	High7.2	—	0.2%	6 days ago
28Monitor	CVE-2026-120512No exploit	Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value10web · form maker by 10web – mobile-friendly drag & drop contact form builder · CWE-79 Pre-auth XSS	High7.2	—	0.2%	6 days ago
28Monitor	CVE-2026-120540No exploit	iubenda \| All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIEiubenda · iubenda \| all-in-one compliance for gdpr / ccpa cookie consent + more · CWE-79 Pre-auth XSS	High7.2	—	0.2%	6 days ago
39Monitor	CVE-2026-93754No exploit	payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Executionpayever · payever checkout – composable payment gateway · CWE-434 pre-auth RCE File upload	Critical9.8	—	0.8%	6 days ago
28Monitor	CVE-2026-119158No exploit	Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatargenetechproducts · pie register – user registration, profiles & content restriction · CWE-79 Pre-auth XSS	High7.2	—	0.2%	6 days ago
28Monitor	CVE-2026-120677No exploit	Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Contentoptimole · optimole – optimize images \| convert webp & avif \| cdn & lazy load \| image optimization · CWE-79 Pre-auth XSS	High7.2	—	0.2%	6 days ago
28Monitor	CVE-2026-120739No exploit	Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptoroptimole · optimole – optimize images \| convert webp & avif \| cdn & lazy load \| image optimization · CWE-79 Pre-auth XSS	High7.2	—	0.3%	6 days ago
69This week	CVE-2026-123218Weaponized	IBM Aspera Faspex Authorization Bypassibm · aspera faspex · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	KEV	0.5%	6 days ago
39Monitor	CVE-2026-17362No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	6 days ago
39Monitor	CVE-2026-19803Proof of concept	Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameterprintcart · printcart store – web to print product designer for woocommerce · CWE-94 pre-auth RCE File upload	Critical9.8	—	0.9%	6 days ago
30Monitor	CVE-2026-105002No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-94 RCE	High7.5	—	0.3%	6 days ago
28Monitor	CVE-2026-119167No exploit	TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypasscozmoslabs · translatepress – translate multilingual sites with ai translation · CWE-79 Pre-auth XSS	High7.2	—	0.3%	6 days ago
30Monitor	CVE-2026-120043No exploit	Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameteriovamihai · affiliate program suite — slicewp affiliates · CWE-89 Pre-auth SQL injection	High7.5	—	0.4%	6 days ago
34Monitor	CVE-2026-16709No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-79 RCE XSS	High8.7	—	0.4%	6 days ago
30Monitor	CVE-2026-16712No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High7.7	—	0.4%	6 days ago
30Monitor	CVE-2026-16714No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	6 days ago
30Monitor	CVE-2026-16715No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High7.7	—	0.4%	6 days ago
35Monitor	CVE-2026-16716No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-1259	High8.8	—	0.5%	6 days ago
30Monitor	CVE-2026-16717No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High7.7	—	0.4%	6 days ago
30Monitor	CVE-2026-16718No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-22 Path traversal	High7.7	—	0.7%	6 days ago
39Monitor	CVE-2026-16720No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.7%	6 days ago
30Monitor	CVE-2026-16854No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-89 SQL injection	High7.7	—	0.4%	6 days ago
34Monitor	CVE-2026-16880No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-22 Path traversal	High8.5	—	0.5%	6 days ago
39Monitor	CVE-2026-16884No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-611 Pre-auth XXE	Critical9.9	—	0.4%	6 days ago
34Monitor	CVE-2026-16912No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
37Monitor	CVE-2026-16918No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 Pre-auth SSRF	Critical9.3	—	0.4%	6 days ago
39Monitor	CVE-2026-16920No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-441	Critical9.9	—	0.5%	6 days ago
39Monitor	CVE-2026-17049No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	Critical9.9	—	0.5%	6 days ago
36Monitor	CVE-2026-17066No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-862 Broken access control (IDOR)	Critical9.1	—	0.5%	6 days ago
34Monitor	CVE-2026-17108No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
32Monitor	CVE-2026-17114No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-209 Info leak	High8.1	—	0.4%	6 days ago
35Monitor	CVE-2026-17117No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-915 RCE	High8.8	—	0.8%	6 days ago
32Monitor	CVE-2026-17129No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High8.1	—	0.3%	6 days ago
37Monitor	CVE-2026-17131No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 Pre-auth SSRF	Critical9.3	—	0.4%	6 days ago
35Monitor	CVE-2026-17132No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-89 RCE SQL injection	High8.8	—	0.6%	6 days ago
35Monitor	CVE-2026-17134No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-89 RCE SQL injection	High8.8	—	0.4%	6 days ago
39Monitor	CVE-2026-17146No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-79 RCE XSS	Critical9.9	—	0.6%	6 days ago
35Monitor	CVE-2026-17147No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-22 RCE Path traversal	High8.8	—	0.9%	6 days ago
39Monitor	CVE-2026-17150No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-184 RCE	Critical9.9	—	0.8%	6 days ago
39Monitor	CVE-2026-17158No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-287 Auth bypass	Critical9.9	—	0.6%	6 days ago
34Monitor	CVE-2026-17172No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-290 Auth bypass	High8.5	—	0.5%	6 days ago
34Monitor	CVE-2026-17187No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
34Monitor	CVE-2026-17188No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
34Monitor	CVE-2026-17190No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-79 RCE XSS	High8.7	—	0.4%	6 days ago
34Monitor	CVE-2026-17228No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
35Monitor	CVE-2026-17239No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-22 RCE Path traversal	High8.8	—	0.8%	6 days ago
29Monitor	CVE-2026-17244No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-862 Broken access control (IDOR)	High7.4	—	0.3%	6 days ago
30Monitor	CVE-2026-17278No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-290 Pre-auth Auth bypass	High7.5	—	0.6%	6 days ago
36Monitor	CVE-2026-17280No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-307 Pre-auth	Critical9.1	—	0.5%	6 days ago
30Monitor	CVE-2026-17281No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High7.7	—	0.4%	6 days ago
30Monitor	CVE-2026-17282No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High7.7	—	0.4%	6 days ago
30Monitor	CVE-2026-17283No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High7.7	—	0.4%	6 days ago
34Monitor	CVE-2026-17284No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High8.5	—	0.3%	6 days ago
30Monitor	CVE-2026-17285No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High7.7	—	0.4%	6 days ago
34Monitor	CVE-2026-17287No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
34Monitor	CVE-2026-17288No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
30Monitor	CVE-2026-17289No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High7.7	—	0.4%	6 days ago
34Monitor	CVE-2026-17290No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-290 Auth bypass	High8.5	—	0.3%	6 days ago
36Monitor	CVE-2026-17291No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-601 Open redirect	Critical9.0	—	0.5%	6 days ago
36Monitor	CVE-2026-17292No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	Critical9.1	—	0.3%	6 days ago
34Monitor	CVE-2026-17293No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High8.5	—	0.3%	6 days ago
34Monitor	CVE-2026-17294No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.5	—	0.3%	6 days ago
30Monitor	CVE-2026-17295No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-22 Path traversal	High7.7	—	0.7%	6 days ago
38Monitor	CVE-2026-17296No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	Critical9.6	—	0.4%	6 days ago
38Monitor	CVE-2026-17297No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-601 Pre-auth Open redirect	Critical9.6	—	0.6%	6 days ago
30Monitor	CVE-2026-17298No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High7.7	—	0.5%	6 days ago
32Monitor	CVE-2026-17299No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 SSRF	High8.1	—	0.4%	6 days ago
39Monitor	CVE-2026-17301No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-347 Pre-auth Auth bypass Weak crypto	Critical9.8	—	0.4%	6 days ago
34Monitor	CVE-2026-17306No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-918 Pre-auth SSRF	High8.6	—	0.4%	6 days ago
32Monitor	CVE-2026-17309No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-295 Pre-auth Weak crypto	High8.0	—	0.1%	6 days ago
28Monitor	CVE-2026-17311No exploit	Multiple Vulnerabilities in IBM API Connectibm · api connect · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	6 days ago

CVE-2026-124027
34Monitor
ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
zhimaai · chatwiki6 days ago
CVE-2026-124040
36Monitor
CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State
CriticalCVSS 9.2Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
civetweb · civetweb6 days ago
CVE-2026-33050
35Monitor
GeoNode: OS command injection via uploaded file layer name
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- Command injection
geonode · geonode6 days ago
CVE-2026-58490
39Monitor
Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
tracecathq · tracecat6 days ago
CVE-2026-65960
35Monitor
Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
- Local privilege escalation
cilium · tetragon6 days ago
CVE-2026-102344
32Monitor
Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Path traversal
kunchenguid · lavish-axi6 days ago
CVE-2026-102530
37Monitor
JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
- XSS
jupyterlab · jupyterlab-desktop6 days ago
CVE-2026-102657
30Monitor
esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
esm-dev · esm.sh6 days ago
CVE-2026-124078
34Monitor
plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
tootallnate · plist.js6 days ago
CVE-2026-54349
39Monitor
Chartbrew SQL injection in dashboard filter substitution
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
chartbrew · chartbrew6 days ago
CVE-2026-54589
28Monitor
Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)
HighCVSS 7.0No exploitEPSS 0%
- SSRF
chartbrew · chartbrew6 days ago
CVE-2026-63438
39Monitor
2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
bubka · 2fauth6 days ago
CVE-2026-63439
39Monitor
2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
bubka · 2fauth6 days ago
CVE-2026-71397
32Monitor
Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
elixir-grpc · grpc_server6 days ago
CVE-2026-85295
39Monitor
Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
chartbrew · chartbrew6 days ago
CVE-2026-85708
30Monitor
Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
chartbrew · chartbrew6 days ago
CVE-2026-85712
35Monitor
Chartbrew: Cross-tenant project takeover via body.team_id in /project routes
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
chartbrew · chartbrew6 days ago
CVE-2026-85726
30Monitor
Chartbrew: Blind NoSQL injection via date variable in embedded chart
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
chartbrew · chartbrew6 days ago
CVE-2026-85736
32Monitor
Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
chartbrew · chartbrew6 days ago
CVE-2026-86005
37Monitor
Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
chartbrew · chartbrew6 days ago
CVE-2026-86044
38Monitor
JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Open redirect
jupyterlab · jupyterlab-desktop6 days ago
CVE-2026-50240
35Monitor
Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pip
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
red hat · builds for red hat openshift6 days ago
CVE-2026-59104
37Monitor
UgCS server HCI authentication bypass with empty credentials
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
sph engineering · ugcs6 days ago
CVE-2026-68933
30Monitor
Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
chartbrew · chartbrew6 days ago
CVE-2026-68935
36Monitor
Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections
CriticalCVSS 9.1No exploitEPSS 0%
- SSRF
chartbrew · chartbrew6 days ago
CVE-2026-109469
40Plan
Entra Device Registration Elevation of Privilege Vulnerability
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
microsoft · entra device registration6 days ago
CVE-2026-104913
35Monitor
Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
esaia · interactive real estate – floor plan & building visualizer6 days ago
CVE-2026-119070
28Monitor
Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
optimole · optimole – optimize images | convert webp & avif | cdn & lazy load | image optimization6 days ago
CVE-2026-119175
28Monitor
Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
gijo · flying images: optimize and lazy load images for faster page speed6 days ago
CVE-2026-120082
28Monitor
GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
paoltaia · geodirectory – wp business directory plugin and classified listings directory6 days ago
CVE-2026-120512
28Monitor
Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
10web · form maker by 10web – mobile-friendly drag & drop contact form builder6 days ago
CVE-2026-120540
28Monitor
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
iubenda · iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more6 days ago
CVE-2026-93754
39Monitor
payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
payever · payever checkout – composable payment gateway6 days ago
CVE-2026-119158
28Monitor
Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
genetechproducts · pie register – user registration, profiles & content restriction6 days ago
CVE-2026-120677
28Monitor
Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
optimole · optimole – optimize images | convert webp & avif | cdn & lazy load | image optimization6 days ago
CVE-2026-120739
28Monitor
Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
optimole · optimole – optimize images | convert webp & avif | cdn & lazy load | image optimization6 days ago
CVE-2026-123218
69This week
IBM Aspera Faspex Authorization Bypass
CriticalCVSS 9.8KEVWeaponizedEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ibm · aspera faspex6 days ago
CVE-2026-17362
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-19803
39Monitor
Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
printcart · printcart store – web to print product designer for woocommerce6 days ago
CVE-2026-105002
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.5No exploitEPSS 0%
- RCE
ibm · api connect6 days ago
CVE-2026-119167
28Monitor
TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
cozmoslabs · translatepress – translate multilingual sites with ai translation6 days ago
CVE-2026-120043
30Monitor
Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
iovamihai · affiliate program suite — slicewp affiliates6 days ago
CVE-2026-16709
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
ibm · api connect6 days ago
CVE-2026-16712
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-16714
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · api connect6 days ago
CVE-2026-16715
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-16716
35Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.8No exploitEPSS 0%
ibm · api connect6 days ago
CVE-2026-16717
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-16718
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
ibm · api connect6 days ago
CVE-2026-16720
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · api connect6 days ago
CVE-2026-16854
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- SQL injection
ibm · api connect6 days ago
CVE-2026-16880
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
ibm · api connect6 days ago
CVE-2026-16884
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.9No exploitEPSS 0%
- Pre-auth
- XXE
ibm · api connect6 days ago
CVE-2026-16912
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-16918
37Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SSRF
ibm · api connect6 days ago
CVE-2026-16920
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.9No exploitEPSS 0%
ibm · api connect6 days ago
CVE-2026-17049
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17066
36Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17108
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17114
32Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.1No exploitEPSS 0%
- Info leak
ibm · api connect6 days ago
CVE-2026-17117
35Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.8No exploitEPSS 0%
- RCE
ibm · api connect6 days ago
CVE-2026-17129
32Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17131
37Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SSRF
ibm · api connect6 days ago
CVE-2026-17132
35Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
ibm · api connect6 days ago
CVE-2026-17134
35Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
ibm · api connect6 days ago
CVE-2026-17146
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- XSS
ibm · api connect6 days ago
CVE-2026-17147
35Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
ibm · api connect6 days ago
CVE-2026-17150
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
ibm · api connect6 days ago
CVE-2026-17158
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.9No exploitEPSS 0%
- Auth bypass
ibm · api connect6 days ago
CVE-2026-17172
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
ibm · api connect6 days ago
CVE-2026-17187
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17188
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17190
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
ibm · api connect6 days ago
CVE-2026-17228
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17239
35Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
ibm · api connect6 days ago
CVE-2026-17244
29Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.4No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17278
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · api connect6 days ago
CVE-2026-17280
36Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
ibm · api connect6 days ago
CVE-2026-17281
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17282
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17283
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17284
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17285
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17287
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17288
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17289
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17290
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
ibm · api connect6 days ago
CVE-2026-17291
36Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.0No exploitEPSS 0%
- Open redirect
ibm · api connect6 days ago
CVE-2026-17292
36Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17293
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago
CVE-2026-17294
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.5No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17295
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
ibm · api connect6 days ago
CVE-2026-17296
38Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.6No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17297
38Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Open redirect
ibm · api connect6 days ago
CVE-2026-17298
30Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.7No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17299
32Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.1No exploitEPSS 0%
- SSRF
ibm · api connect6 days ago
CVE-2026-17301
39Monitor
Multiple Vulnerabilities in IBM API Connect
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
ibm · api connect6 days ago
CVE-2026-17306
34Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SSRF
ibm · api connect6 days ago
CVE-2026-17309
32Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
ibm · api connect6 days ago
CVE-2026-17311
28Monitor
Multiple Vulnerabilities in IBM API Connect
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · api connect6 days ago