By publication date

Exploited and new serious CVEs: November 2026

3,466 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 18 of 35

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-124561No exploit	D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflowd-link · dir-878 · CWE-119 Pre-auth Memory safety	High7.7	—	0.5%	3 days ago
30Monitor	CVE-2026-124562No exploit	D-Link DIR-878 HNAP SetWanSettings buffer overflowd-link · dir-878 · CWE-119 Pre-auth Memory safety	High7.7	—	0.5%	3 days ago
30Monitor	CVE-2026-124563No exploit	D-Link DIR-878 HNAP SetWanSettings buffer overflowd-link · dir-878 · CWE-119 Pre-auth Memory safety	High7.7	—	0.5%	3 days ago
37Monitor	CVE-2026-113363No exploit	Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and nec corporation · websam winshare · CWE-749 pre-auth RCE	Critical9.3	—	1.0%	3 days ago
37Monitor	CVE-2026-113364No exploit	Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.nec corporation · websam winshare · CWE-122 pre-auth RCE Memory safety	Critical9.3	—	0.7%	3 days ago
35Monitor	CVE-2026-115204No exploit	AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_importunknown · azexo store locator · CWE-434 RCE File upload	High8.8	—	0.4%	3 days ago
35Monitor	CVE-2026-115212No exploit	mView <= 1.0.3 - Subscriber+ Arbitrary File Uploadunknown · mview 豆瓣电影 · CWE-434 RCE File upload	High8.8	—	0.4%	3 days ago
39Monitor	CVE-2026-115213No exploit	EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypassunknown · easy-js-wpapi client handle for the wordpress rest-api · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.3%	3 days ago
39Monitor	CVE-2026-115237No exploit	Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Codeunknown · grand job · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.2%	3 days ago
30Monitor	CVE-2026-115256No exploit	Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeoverunknown · mail debug for woocommerce · CWE-200 Pre-auth Info leak	High7.5	—	0.2%	3 days ago
30Monitor	CVE-2026-118201No exploit	Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPCunknown · limit login attempts security · CWE-287 Auth bypass	High7.5	—	0.2%	3 days ago
30Monitor	CVE-2026-118202No exploit	Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Headerunknown · limit login attempts security · CWE-287 Auth bypass	High7.5	—	0.2%	3 days ago
28Monitor	CVE-2026-121874No exploit	Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Nameunknown · post duplicator · CWE-863 Broken access control (IDOR)	High7.2	—	0.2%	3 days ago
28Monitor	CVE-2026-121875No exploit	Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignmentunknown · post duplicator · CWE-269	High7.2	—	0.2%	3 days ago
35Monitor	CVE-2026-123064No exploit	WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalationunknown · wp base booking of appointments, services and events · CWE-269	High8.8	—	0.2%	3 days ago
30Monitor	CVE-2026-123091No exploit	Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Formsunknown · vigilant · CWE-287 Auth bypass	High7.5	—	0.2%	3 days ago
39Monitor	CVE-2026-123751No exploit	WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypassunknown · wp duplicate · CWE-434 pre-auth RCE Auth bypass File upload	Critical9.8	—	0.6%	3 days ago
27Monitor	CVE-2026-124576Proof of concept	BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflowCWE-840 Pre-auth	Medium6.9	—	0.3%	3 days ago
36Monitor	CVE-2026-124577No exploit	Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authenticationintelbras · sg 2404 poe l2+ · CWE-287 Pre-auth Auth bypass	High8.9	—	2.0%	3 days ago
38Monitor	CVE-2026-124580No exploit	Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injectionchengdu feiyuxing technology · vw2100 · CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.7%	3 days ago
38Monitor	CVE-2026-123870No exploit	[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unseteclipse foundation · otterdog · CWE-95 pre-auth RCE	Critical9.5	—	0.3%	3 days ago
35Monitor	CVE-2026-124585No exploit	Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injectionchengdu feiyuxing technology · vw2100 · CWE-77 RCE Command injection	High8.6	—	2.2%	3 days ago
24Monitor	CVE-2026-92606Proof of concept	TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputertübi̇tak bi̇lgem software technologies research institute · pardus mycomputer · CWE-367 Race condition	Medium6.0	—	0.0%	3 days ago
32Monitor	CVE-2026-94249No exploit	Missing Authorization in TÜBİTAK BİLGEM's Liderahenktübi̇tak bi̇lgem software technologies research institute · liderahenk · CWE-862 Broken access control (IDOR)	High8.1	—	0.2%	3 days ago
28Monitor	CVE-2026-111403No exploit	WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilitywp inventory · wp inventory manager · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
35Monitor	CVE-2026-111421No exploit	Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API serverapache software foundation · apache airflow · CWE-502 Deserialization	High8.8	—	0.6%	3 days ago
28Monitor	CVE-2026-119483No exploit	WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability10web · form maker by 10web · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
28Monitor	CVE-2026-119504No exploit	WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerabilitydynamiapps · frontend admin by dynamiapps · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
28Monitor	CVE-2026-119505No exploit	WordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerabilitywelcart · welcart e-commerce · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
30Monitor	CVE-2026-121760No exploit	WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerabilitywedevs · wedocs · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	3 days ago
28Monitor	CVE-2026-121764No exploit	WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerabilityfoliovision · fv flowplayer video player · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
28Monitor	CVE-2026-121780No exploit	WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerabilitygijo varghese · flying images · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
28Monitor	CVE-2026-123463No exploit	WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilitywp wham · checkout files upload for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
30Monitor	CVE-2026-123465No exploit	WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerabilitymycred · mycred · CWE-497 Pre-auth Info leak	High7.5	—	0.3%	3 days ago
28Monitor	CVE-2026-123484No exploit	WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilitycrocoblock · jetformbuilder · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
28Monitor	CVE-2026-54863No exploit	WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilitymamunur rashid · review schema · CWE-79 Pre-auth XSS	High7.1	—	0.1%	3 days ago
0Monitor	CVE-2026-68982Proof of concept	Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validationapache software foundation · apache airflow · CWE-306 RCE Auth bypass	—	—	0.2%	3 days ago
0Monitor	CVE-2026-86829Proof of concept	Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluationapache software foundation · apache airflow · CWE-502 Deserialization	—	—	0.2%	3 days ago
34Monitor	CVE-2026-92683No exploit	Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphqlneo4j · @neo4j/graphql · CWE-863 Broken access control (IDOR)	High8.6	—	0.4%	3 days ago
30Monitor	CVE-2026-106466No exploit	JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocationunknown · jwt auth · CWE-613	High7.5	—	0.2%	2 days ago
40Plan	CVE-2026-115252Proof of concept	Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Optionunknown · confection wordpress cable · CWE-94 pre-auth RCE	Critical10.0	—	0.4%	2 days ago
30Monitor	CVE-2026-120367No exploit	Apache Axis2/Java: unbounded JSON request body bufferingapache software foundation · apache axis2/java · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	2 days ago
28Monitor	CVE-2026-121570No exploit	WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerabilitywp chill · rsvp and event management · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
30Monitor	CVE-2026-121722No exploit	WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerabilitywp e-signature · formidable forms signature online contract automation · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	2 days ago
28Monitor	CVE-2026-121782No exploit	WordPress If-So Dynamic Content Personalization plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerabilityif-so dynamic content · if-so dynamic content personalization · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
28Monitor	CVE-2026-122666No exploit	WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilitykitae park · mang board wp · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
28Monitor	CVE-2026-123460No exploit	WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerabilitynickboss · wordpress file upload · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
30Monitor	CVE-2026-123475No exploit	WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerabilitypt norther lights production · mapsvg · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	2 days ago
28Monitor	CVE-2026-123476No exploit	WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerabilityfifu.app · featured image from url · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
0Monitor	CVE-2026-123753Proof of concept	Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpointsapache software foundation · apache axis2/java · CWE-918 SSRF	—	—	0.2%	2 days ago
32Monitor	CVE-2026-112172No exploit	Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructurecompugroup medical · xdent · CWE-89 pre-auth RCE SQL injection	High8.1	—	0.3%	2 days ago
32Monitor	CVE-2026-118458No exploit	AIS shared test login provider contains fixed administrative credentialscompugroup medical · phronesis · CWE-798 Pre-auth Hard-coded credentials	High8.1	—	0.2%	2 days ago
32Monitor	CVE-2026-118460No exploit	AIS embedded private keys enable practitioner impersonationcompugroup medical · infantia · CWE-321 Pre-auth Hard-coded credentials	High8.0	—	0.2%	2 days ago
32Monitor	CVE-2026-118461No exploit	AIS PersonnelService client performs unauthenticated doctor-specific operationscompugroup medical · infantia · CWE-306 Pre-auth Auth bypass	High8.0	—	0.3%	2 days ago
36Monitor	CVE-2026-118462No exploit	AIS update mechanism executes unverified codecompugroup medical · infantia · CWE-494 Pre-auth	Critical9.2	—	0.1%	2 days ago
28Monitor	CVE-2026-118468No exploit	AIS XML parsers allow external entity resolutioncompugroup medical · infantia · CWE-611 Pre-auth XXE	High7.2	—	0.2%	2 days ago
30Monitor	CVE-2026-121629No exploit	Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handlingred hat · red hat enterprise linux 10 · CWE-73 Pre-auth Path traversal	High7.5	—	0.5%	2 days ago
40Plan	CVE-2026-110468Proof of concept	Remote Code Execution via Unrestricted File Upload in WidzialniCMSfundacja widzialni · widzialnicms · CWE-434 pre-auth RCE File upload	Critical10.0	—	0.6%	2 days ago
40Plan	CVE-2026-110469No exploit	Remote Code Execution via Unrestricted File Upload in WidzialniCMSfundacja widzialni · widzialnicms · CWE-434 pre-auth RCE File upload	Critical10.0	—	0.6%	2 days ago
28Monitor	CVE-2026-118790No exploit	Multiple Hardcoded Credentialscompugroup medical · wingesfar · CWE-798 Pre-auth Hard-coded credentials	High7.2	—	0.2%	2 days ago
28Monitor	CVE-2026-118791No exploit	Insecure software update mechanismcompugroup medical · wingesfar · CWE-494 Pre-auth	High7.2	—	0.1%	2 days ago
32Monitor	CVE-2026-119610No exploit	Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned underflowred hat · red hat enterprise linux 10 · CWE-125 Pre-auth Memory safety	High8.2	—	0.7%	2 days ago
30Monitor	CVE-2026-120854No exploit	WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerabilityiubenda · iubenda · CWE-770 Pre-auth Denial of service	High7.5	—	0.3%	2 days ago
28Monitor	CVE-2026-120856No exploit	WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityrymera web co · invoice gateway for woocommerce – invoice payment gateway · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
37Monitor	CVE-2026-124079Proof of concept	rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoningrconfig · rconfig core · CWE-502 pre-auth RCE Auth bypass Deserialization	Critical9.3	—	0.6%	2 days ago
35Monitor	CVE-2026-94434Proof of concept	OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repairtübi̇tak bi̇lgem software technologies research institute · pardus boot repair · CWE-78 RCE Command injection	High8.8	—	1.2%	2 days ago
32Monitor	CVE-2026-95648No exploit	Privilege Escalation in C-Prot's C-Prot AppDefensec-prot inc. · c-prot appdefense · CWE-915	High8.1	—	0.2%	2 days ago
35Monitor	CVE-2026-121842No exploit	Privilege escalation in the Reader View component in Firefox for iOSmozilla · firefox for ios Pre-auth	High8.8	—	0.2%	2 days ago
35Monitor	CVE-2026-121843No exploit	Privilege escalation in Firefox for iOSmozilla · firefox for ios Pre-auth	High8.8	—	0.2%	2 days ago
35Monitor	CVE-2026-16283No exploit	Command Injection in Osbil Technology's Ltd's oPanelosbil technology ltd.osbil technology ltd. · opanel · CWE-78 RCE Command injection	High8.8	—	0.8%	2 days ago
35Monitor	CVE-2026-95778No exploit	A remote code execution vulnerability exists in HPE Morpheus Software.hewlett packard enterprise (hpe) · hpe morpheus software RCE	High8.8	—	0.5%	2 days ago
35Monitor	CVE-2026-95779No exploit	An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software.hewlett packard enterprise (hpe) · hpe morpheus software · CWE-200 Info leak	High8.8	—	0.2%	2 days ago
34Monitor	CVE-2026-104620No exploit	PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)packagekit · packagekit · CWE-23 Path traversal Local privilege escalation	High8.5	—	0.1%	2 days ago
31Monitor	CVE-2026-119474No exploit	Privilege Escalation in HAVELSAN's Liman Render Enginehavelsan inc. · liman render engine · CWE-732 Local privilege escalation	High7.8	—	0.0%	2 days ago
29Monitor	CVE-2026-124850No exploit	SQL Injection in Database Migration via Stored Connector Identifiers in flowintelflowintel · flowintel · CWE-89 SQL injection	High7.3	—	0.1%	2 days ago
28Monitor	CVE-2025-10248No exploit	XSS vulnerability in OpenText Filropentext · filr · CWE-79 XSS	High7.2	—	0.3%	2 days ago
31Monitor	CVE-2026-103906No exploit	Disabled TLS Certificate Validation Enables MITM Attacksam_automatic_machines · am_club · CWE-798 Pre-auth Hard-coded credentials	High7.8	—	0.3%	2 days ago
37Monitor	CVE-2026-104989No exploit	Pre-authentication remote code execution in Chaos V-Ray Swarmchaos software · v-ray swarm · CWE-427 pre-auth RCE	Critical9.3	—	0.5%	2 days ago
32Monitor	CVE-2026-115338No exploit	Insecure XFT Transport in Progress WS_FTP Serverprogress software · ws_ftp server · CWE-319 Pre-auth Weak crypto	High8.1	—	0.1%	2 days ago
30Monitor	CVE-2026-115339No exploit	Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Serverprogress software · ws_ftp server · CWE-770 Pre-auth Denial of service	High7.5	—	0.3%	2 days ago
28Monitor	CVE-2026-115340No exploit	Insecure Storage of Web Transfer Credentials in Progress WS_FTP Serverprogress software · ws_ftp server · CWE-312	High7.1	—	0.0%	2 days ago
30Monitor	CVE-2026-115341No exploit	Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Serverprogress software · ws_ftp server · CWE-22 Path traversal	High7.7	—	0.4%	2 days ago
35Monitor	CVE-2026-121576No exploit	WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerabilityatlasaidev · mcp server for wordpress · CWE-266	High8.8	—	0.3%	2 days ago
28Monitor	CVE-2026-122664No exploit	WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerabilityvideowhisper.com · broadcast live video · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
28Monitor	CVE-2026-123482No exploit	WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilitycrocoblock · jetformbuilder · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
34Monitor	CVE-2026-124683No exploit	Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokeclipse foundation · eclipse langium · CWE-407 Pre-auth	High8.7	—	0.4%	2 days ago
30Monitor	CVE-2026-119755No exploit	Tasmota 16.0.0 CSRF via Referer Header Validation Bypassarendst · tasmota · CWE-352 Pre-auth CSRF	High7.5	—	0.1%	2 days ago
37Monitor	CVE-2026-119756No exploit	Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDParendst · tasmota · CWE-805 Pre-auth	Critical9.3	—	0.4%	2 days ago
39Monitor	CVE-2026-123270Proof of concept	Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (Rredpanda data · connect · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	0.6%	2 days ago
29Monitor	CVE-2026-123367No exploit	ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoderthorvg · thorvg · CWE-787 Pre-auth Memory safety Denial of service	High7.4	—	0.2%	2 days ago
30Monitor	CVE-2026-123797No exploit	SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcementsupertokens · supertokens-core · CWE-288 Pre-auth Auth bypass	High7.5	—	0.4%	2 days ago
33Monitor	CVE-2026-19706No exploit	Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrapred hat · assisted installer for red hat openshift container platform 2 · CWE-306 Pre-auth Auth bypass	High8.3	—	0.1%	2 days ago
30Monitor	CVE-2026-112314No exploit	Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retriesred hat · red hat enterprise linux 10 · CWE-772 Pre-auth Denial of service	High7.5	—	0.9%	2 days ago
30Monitor	CVE-2026-112320No exploit	Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switchingred hat · red hat enterprise linux 10 · CWE-772 Pre-auth Denial of service	High7.5	—	0.7%	2 days ago
30Monitor	CVE-2026-112321No exploit	Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error pathsred hat · red hat enterprise linux 10 · CWE-772 Pre-auth Denial of service	High7.5	—	0.9%	2 days ago
30Monitor	CVE-2026-112322No exploit	Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanupred hat · red hat enterprise linux 10 · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	2 days ago
30Monitor	CVE-2026-112323No exploit	Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requestsred hat · red hat enterprise linux 10 · CWE-772 Pre-auth Denial of service	High7.5	—	0.6%	2 days ago
30Monitor	CVE-2026-119079No exploit	Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decodingred hat · red hat enterprise linux 10 · CWE-408 Pre-auth Denial of service	High7.5	—	0.6%	2 days ago
29Monitor	CVE-2026-120834No exploit	WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerabilitytobias · wp2leads · CWE-266 Pre-auth	High7.3	—	0.2%	2 days ago
34Monitor	CVE-2026-121769No exploit	WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerabilityaxew3.com · wp w3all phpbb · CWE-89 SQL injection	High8.5	—	0.2%	2 days ago

CVE-2026-124561
30Monitor
D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
d-link · dir-8783 days ago
CVE-2026-124562
30Monitor
D-Link DIR-878 HNAP SetWanSettings buffer overflow
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
d-link · dir-8783 days ago
CVE-2026-124563
30Monitor
D-Link DIR-878 HNAP SetWanSettings buffer overflow
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
d-link · dir-8783 days ago
CVE-2026-113363
37Monitor
Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
nec corporation · websam winshare3 days ago
CVE-2026-113364
37Monitor
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
nec corporation · websam winshare3 days ago
CVE-2026-115204
35Monitor
AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
unknown · azexo store locator3 days ago
CVE-2026-115212
35Monitor
mView <= 1.0.3 - Subscriber+ Arbitrary File Upload
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
unknown · mview 豆瓣电影3 days ago
CVE-2026-115213
39Monitor
EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · easy-js-wpapi client handle for the wordpress rest-api3 days ago
CVE-2026-115237
39Monitor
Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · grand job3 days ago
CVE-2026-115256
30Monitor
Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
unknown · mail debug for woocommerce3 days ago
CVE-2026-118201
30Monitor
Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · limit login attempts security3 days ago
CVE-2026-118202
30Monitor
Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · limit login attempts security3 days ago
CVE-2026-121874
28Monitor
Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
unknown · post duplicator3 days ago
CVE-2026-121875
28Monitor
Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment
HighCVSS 7.2No exploitEPSS 0%
unknown · post duplicator3 days ago
CVE-2026-123064
35Monitor
WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation
HighCVSS 8.8No exploitEPSS 0%
unknown · wp base booking of appointments, services and events3 days ago
CVE-2026-123091
30Monitor
Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
unknown · vigilant3 days ago
CVE-2026-123751
39Monitor
WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- File upload
unknown · wp duplicate3 days ago
CVE-2026-124576
27Monitor
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
3 days ago
CVE-2026-124577
36Monitor
Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication
HighCVSS 8.9No exploitEPSS 2%
- Pre-auth
- Auth bypass
intelbras · sg 2404 poe l2+3 days ago
CVE-2026-124580
38Monitor
Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
chengdu feiyuxing technology · vw21003 days ago
CVE-2026-123870
38Monitor
[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset
CriticalCVSS 9.5No exploitEPSS 0%
- pre-auth RCE
eclipse foundation · otterdog3 days ago
CVE-2026-124585
35Monitor
Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
chengdu feiyuxing technology · vw21003 days ago
CVE-2026-92606
24Monitor
TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputer
MediumCVSS 6.0Proof of conceptEPSS 0%
- Race condition
tübi̇tak bi̇lgem software technologies research institute · pardus mycomputer3 days ago
CVE-2026-94249
32Monitor
Missing Authorization in TÜBİTAK BİLGEM's Liderahenk
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
tübi̇tak bi̇lgem software technologies research institute · liderahenk3 days ago
CVE-2026-111403
28Monitor
WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp inventory · wp inventory manager3 days ago
CVE-2026-111421
35Monitor
Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
apache software foundation · apache airflow3 days ago
CVE-2026-119483
28Monitor
WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
10web · form maker by 10web3 days ago
CVE-2026-119504
28Monitor
WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
dynamiapps · frontend admin by dynamiapps3 days ago
CVE-2026-119505
28Monitor
WordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
welcart · welcart e-commerce3 days ago
CVE-2026-121760
30Monitor
WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wedevs · wedocs3 days ago
CVE-2026-121764
28Monitor
WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
foliovision · fv flowplayer video player3 days ago
CVE-2026-121780
28Monitor
WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
gijo varghese · flying images3 days ago
CVE-2026-123463
28Monitor
WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp wham · checkout files upload for woocommerce3 days ago
CVE-2026-123465
30Monitor
WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
mycred · mycred3 days ago
CVE-2026-123484
28Monitor
WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crocoblock · jetformbuilder3 days ago
CVE-2026-54863
28Monitor
WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
mamunur rashid · review schema3 days ago
CVE-2026-68982
0Monitor
Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Proof of conceptEPSS 0%
- RCE
- Auth bypass
apache software foundation · apache airflow3 days ago
CVE-2026-86829
0Monitor
Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Proof of conceptEPSS 0%
- Deserialization
apache software foundation · apache airflow3 days ago
CVE-2026-92683
34Monitor
Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
neo4j · @neo4j/graphql3 days ago
CVE-2026-106466
30Monitor
JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocation
HighCVSS 7.5No exploitEPSS 0%
unknown · jwt auth2 days ago
CVE-2026-115252
40Plan
Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option
CriticalCVSS 10.0Proof of conceptEPSS 0%
- pre-auth RCE
unknown · confection wordpress cable2 days ago
CVE-2026-120367
30Monitor
Apache Axis2/Java: unbounded JSON request body buffering
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache axis2/java2 days ago
CVE-2026-121570
28Monitor
WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wp chill · rsvp and event management2 days ago
CVE-2026-121722
30Monitor
WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wp e-signature · formidable forms signature online contract automation2 days ago
CVE-2026-121782
28Monitor
WordPress If-So Dynamic Content Personalization plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
if-so dynamic content · if-so dynamic content personalization2 days ago
CVE-2026-122666
28Monitor
WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kitae park · mang board wp2 days ago
CVE-2026-123460
28Monitor
WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nickboss · wordpress file upload2 days ago
CVE-2026-123475
30Monitor
WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
pt norther lights production · mapsvg2 days ago
CVE-2026-123476
28Monitor
WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
fifu.app · featured image from url2 days ago
CVE-2026-123753
0Monitor
Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Proof of conceptEPSS 0%
- SSRF
apache software foundation · apache axis2/java2 days ago
CVE-2026-112172
32Monitor
Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- SQL injection
compugroup medical · xdent2 days ago
CVE-2026-118458
32Monitor
AIS shared test login provider contains fixed administrative credentials
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
compugroup medical · phronesis2 days ago
CVE-2026-118460
32Monitor
AIS embedded private keys enable practitioner impersonation
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
compugroup medical · infantia2 days ago
CVE-2026-118461
32Monitor
AIS PersonnelService client performs unauthenticated doctor-specific operations
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
compugroup medical · infantia2 days ago
CVE-2026-118462
36Monitor
AIS update mechanism executes unverified code
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
compugroup medical · infantia2 days ago
CVE-2026-118468
28Monitor
AIS XML parsers allow external entity resolution
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XXE
compugroup medical · infantia2 days ago
CVE-2026-121629
30Monitor
Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
red hat · red hat enterprise linux 102 days ago
CVE-2026-110468
40Plan
Remote Code Execution via Unrestricted File Upload in WidzialniCMS
CriticalCVSS 10.0Proof of conceptEPSS 0%
- pre-auth RCE
- File upload
fundacja widzialni · widzialnicms2 days ago
CVE-2026-110469
40Plan
Remote Code Execution via Unrestricted File Upload in WidzialniCMS
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- File upload
fundacja widzialni · widzialnicms2 days ago
CVE-2026-118790
28Monitor
Multiple Hardcoded Credentials
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
compugroup medical · wingesfar2 days ago
CVE-2026-118791
28Monitor
Insecure software update mechanism
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
compugroup medical · wingesfar2 days ago
CVE-2026-119610
32Monitor
Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned underflow
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
red hat · red hat enterprise linux 102 days ago
CVE-2026-120854
30Monitor
WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
iubenda · iubenda2 days ago
CVE-2026-120856
28Monitor
WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
rymera web co · invoice gateway for woocommerce – invoice payment gateway2 days ago
CVE-2026-124079
37Monitor
rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
- Deserialization
rconfig · rconfig core2 days ago
CVE-2026-94434
35Monitor
OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair
HighCVSS 8.8Proof of conceptEPSS 1%
- RCE
- Command injection
tübi̇tak bi̇lgem software technologies research institute · pardus boot repair2 days ago
CVE-2026-95648
32Monitor
Privilege Escalation in C-Prot's C-Prot AppDefense
HighCVSS 8.1No exploitEPSS 0%
c-prot inc. · c-prot appdefense2 days ago
CVE-2026-121842
35Monitor
Privilege escalation in the Reader View component in Firefox for iOS
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefox for ios2 days ago
CVE-2026-121843
35Monitor
Privilege escalation in Firefox for iOS
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefox for ios2 days ago
CVE-2026-16283
35Monitor
Command Injection in Osbil Technology's Ltd's oPanel
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
osbil technology ltd.osbil technology ltd. · opanel2 days ago
CVE-2026-95778
35Monitor
A remote code execution vulnerability exists in HPE Morpheus Software.
HighCVSS 8.8No exploitEPSS 0%
- RCE
hewlett packard enterprise (hpe) · hpe morpheus software2 days ago
CVE-2026-95779
35Monitor
An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software.
HighCVSS 8.8No exploitEPSS 0%
- Info leak
hewlett packard enterprise (hpe) · hpe morpheus software2 days ago
CVE-2026-104620
34Monitor
PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
- Local privilege escalation
packagekit · packagekit2 days ago
CVE-2026-119474
31Monitor
Privilege Escalation in HAVELSAN's Liman Render Engine
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
havelsan inc. · liman render engine2 days ago
CVE-2026-124850
29Monitor
SQL Injection in Database Migration via Stored Connector Identifiers in flowintel
HighCVSS 7.3No exploitEPSS 0%
- SQL injection
flowintel · flowintel2 days ago
CVE-2025-10248
28Monitor
XSS vulnerability in OpenText Filr
HighCVSS 7.2No exploitEPSS 0%
- XSS
opentext · filr2 days ago
CVE-2026-103906
31Monitor
Disabled TLS Certificate Validation Enables MITM Attacks
HighCVSS 7.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
am_automatic_machines · am_club2 days ago
CVE-2026-104989
37Monitor
Pre-authentication remote code execution in Chaos V-Ray Swarm
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
chaos software · v-ray swarm2 days ago
CVE-2026-115338
32Monitor
Insecure XFT Transport in Progress WS_FTP Server
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
progress software · ws_ftp server2 days ago
CVE-2026-115339
30Monitor
Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
progress software · ws_ftp server2 days ago
CVE-2026-115340
28Monitor
Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server
HighCVSS 7.1No exploitEPSS 0%
progress software · ws_ftp server2 days ago
CVE-2026-115341
30Monitor
Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
progress software · ws_ftp server2 days ago
CVE-2026-121576
35Monitor
WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
atlasaidev · mcp server for wordpress2 days ago
CVE-2026-122664
28Monitor
WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
videowhisper.com · broadcast live video2 days ago
CVE-2026-123482
28Monitor
WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crocoblock · jetformbuilder2 days ago
CVE-2026-124683
34Monitor
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTok
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse langium2 days ago
CVE-2026-119755
30Monitor
Tasmota 16.0.0 CSRF via Referer Header Validation Bypass
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- CSRF
arendst · tasmota2 days ago
CVE-2026-119756
37Monitor
Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
arendst · tasmota2 days ago
CVE-2026-123270
39Monitor
Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (R
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
redpanda data · connect2 days ago
CVE-2026-123367
29Monitor
ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
thorvg · thorvg2 days ago
CVE-2026-123797
30Monitor
SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
supertokens · supertokens-core2 days ago
CVE-2026-19706
33Monitor
Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
red hat · assisted installer for red hat openshift container platform 22 days ago
CVE-2026-112314
30Monitor
Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 102 days ago
CVE-2026-112320
30Monitor
Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 102 days ago
CVE-2026-112321
30Monitor
Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 102 days ago
CVE-2026-112322
30Monitor
Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 102 days ago
CVE-2026-112323
30Monitor
Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 102 days ago
CVE-2026-119079
30Monitor
Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 102 days ago
CVE-2026-120834
29Monitor
WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerability
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
tobias · wp2leads2 days ago
CVE-2026-121769
34Monitor
WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
axew3.com · wp w3all phpbb2 days ago