By publication date

Exploited and new serious CVEs: November 2026

1,240 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 7 of 13

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-95860No exploit	node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissionsnode-opcua · node-opcua · CWE-285 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	3 days ago
37Monitor	CVE-2026-112354No exploit	Etrel INCH AC Charging Station Hard-coded Default Credentialsetrel d.o.o. · etrel inch · CWE-1392 Pre-auth Hard-coded credentials	Critical9.3	—	0.5%	3 days ago
28Monitor	CVE-2026-115541No exploit	HumHub 1.19.0 - Stored cross-site scripting in friendship confirmationhumhub · humhub community edition · CWE-79 XSS	High7.2	—	0.4%	3 days ago
29Monitor	CVE-2026-118865No exploit	Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Componenttp-link systems inc. · archer ax3000 v2 · CWE-78 RCE Command injection	High7.3	—	0.8%	3 days ago
36Monitor	CVE-2026-119084No exploit	Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parametersaws · amazon-redshift-jdbc-driver · CWE-470 pre-auth RCE	Critical9.2	—	0.4%	3 days ago
38Monitor	CVE-2026-120931No exploit	Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outsigoogle · chrome · CWE-787 pre-auth RCE Memory safety	Critical9.6	—	0.4%	3 days ago
28Monitor	CVE-2026-121614No exploit	Docker Sandboxes host Git executes repository-controlled programsdocker · docker sandboxes · CWE-15	High7.1	—	0.1%	3 days ago
36Monitor	CVE-2026-22058No exploit	CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)netapp · storagegrid (formerly storagegrid webscale) · CWE-288 Pre-auth Auth bypass	Critical9.1	—	0.2%	3 days ago
37Monitor	CVE-2022-29966No exploit	Emerson Ovation Missing Authentication for Critical Functionalityemerson · ovation · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.3%	3 days ago
34Monitor	CVE-2022-30267No exploit	Emerson Ovation Insufficient Verification of Data Authenticityemerson · ovation · CWE-345 pre-auth RCE	High8.7	—	0.3%	3 days ago
30Monitor	CVE-2026-104608No exploit	Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git servicegithub · enterprise server · CWE-416 RCE Memory safety	High7.7	—	0.4%	3 days ago
33Monitor	CVE-2026-109836No exploit	The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical memalcpu · core temp · CWE-782	High8.4	—	0.1%	3 days ago
30Monitor	CVE-2026-116650No exploit	Tanium addressed an unauthorized code execution vulnerability in Threat Response.tanium · threat response · CWE-78 RCE Command injection	High7.5	—	0.3%	3 days ago
30Monitor	CVE-2026-116651No exploit	Tanium addressed an unauthorized code execution vulnerability in Threat Response.tanium · threat response · CWE-78 RCE Command injection	High7.5	—	0.3%	3 days ago
28Monitor	CVE-2026-120775No exploit	Tanium addressed a heap-based buffer overflow vulnerability in Deploy.tanium · deploy · CWE-122 Memory safety	High7.2	—	0.3%	3 days ago
29Monitor	CVE-2026-121565No exploit	Tanium addressed an improper certificate validation vulnerability in multiple productstanium · tanos · CWE-295 Pre-auth Weak crypto	High7.4	—	0.1%	3 days ago
34Monitor	CVE-2026-121727No exploit	Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()jorisvink · kore · CWE-191 Pre-auth Memory safety	High8.7	—	0.3%	3 days ago
28Monitor	CVE-2026-121729No exploit	emailflare before commit cf31f33 Missing Authorization via /api/keys Routes0xdps · emailflare · CWE-862 Broken access control (IDOR)	High7.2	—	0.2%	3 days ago
28Monitor	CVE-2026-121730No exploit	emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint0xdps · emailflare · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	3 days ago
34Monitor	CVE-2026-121731No exploit	RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Reportfrancoisjacquet · rosariosis · CWE-89 SQL injection	High8.7	—	0.3%	3 days ago
39Monitor	CVE-2026-114549No exploit	NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerabilitynomachine · nomachine · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	0.5%	3 days ago
32Monitor	CVE-2026-114550Proof of concept	libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerabilitylibwebsockets · libwebsockets · CWE-787 pre-auth RCE Memory safety	High8.1	—	0.8%	3 days ago
31Monitor	CVE-2026-118623No exploit	MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerabilitymlflow · mlflow · CWE-502 RCE Deserialization	High7.8	—	0.3%	3 days ago
31Monitor	CVE-2026-118627No exploit	MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerabilitymlflow · mlflow · CWE-502 RCE Deserialization	High7.8	—	0.1%	3 days ago
32Monitor	CVE-2026-118628No exploit	MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerabilitymlflow · mlflow · CWE-918 Pre-auth SSRF	High8.2	—	0.3%	3 days ago
34Monitor	CVE-2026-121597No exploit	A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104.CWE-119 Memory safety	High8.6	—	0.6%	3 days ago
29Monitor	CVE-2026-92185No exploit	Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerabilityquest · foglight for databases · CWE-611 Pre-auth XXE	High7.2	—	1.8%	3 days ago
35Monitor	CVE-2026-92186No exploit	Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-22 RCE Path traversal	High8.8	—	1.2%	3 days ago
35Monitor	CVE-2026-92187No exploit	Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-22 RCE Path traversal	High8.8	—	1.2%	3 days ago
39Monitor	CVE-2026-92188No exploit	Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	0.5%	3 days ago
39Monitor	CVE-2026-92189No exploit	Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-73 pre-auth RCE Path traversal	Critical9.8	—	0.6%	3 days ago
39Monitor	CVE-2026-92190No exploit	Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.6%	3 days ago
35Monitor	CVE-2026-92191No exploit	Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-863 RCE Broken access control (IDOR)	High8.8	—	0.5%	3 days ago
35Monitor	CVE-2026-92192No exploit	Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-22 RCE Path traversal	High8.8	—	1.2%	3 days ago
35Monitor	CVE-2026-92194No exploit	Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-22 RCE Path traversal	High8.8	—	1.2%	3 days ago
35Monitor	CVE-2026-92195No exploit	Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-22 RCE Path traversal	High8.8	—	1.2%	3 days ago
28Monitor	CVE-2026-92196No exploit	Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-1336 RCE SSTI	High7.2	—	0.6%	3 days ago
35Monitor	CVE-2026-92197No exploit	Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerabilityquest · foglight for databases · CWE-22 RCE Path traversal	High8.8	—	1.2%	3 days ago
33Monitor	CVE-2026-92198No exploit	Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerabilityquest · foglight for databases · CWE-611 Pre-auth XXE	High8.2	—	2.7%	3 days ago
31Monitor	CVE-2026-92199No exploit	Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerabilityquest · foglight for databases · CWE-321 RCE Local privilege escalation Hard-coded credentials	High7.8	—	0.0%	3 days ago
31Monitor	CVE-2026-92200No exploit	Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerabilityquest · foglight for databases · CWE-732 RCE Local privilege escalation	High7.8	—	0.1%	3 days ago
31Monitor	CVE-2026-92211No exploit	Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerabilitypixar animation studio · openusd · CWE-415 RCE Memory safety	High7.8	—	0.1%	3 days ago
34Monitor	CVE-2026-121598No exploit	TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflowtotolink · a950rg · CWE-119 Memory safety	High8.6	—	0.4%	3 days ago
34Monitor	CVE-2026-121599No exploit	TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflowtotolink · a950rg · CWE-119 Memory safety	High8.6	—	0.4%	3 days ago
34Monitor	CVE-2026-121600No exploit	TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflowtotolink · a950rg · CWE-119 Memory safety	High8.6	—	0.4%	3 days ago
37Monitor	CVE-2026-121606No exploit	Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verificationqihoo 360 · d621-2 · CWE-345 Pre-auth	Critical9.3	—	0.2%	3 days ago
34Monitor	CVE-2026-112116No exploit	An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbasus · system control interface · CWE-782 Local privilege escalation	High8.5	—	0.1%	3 days ago
38Monitor	CVE-2026-121607No exploit	Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injectionqihoo 360 · d603-2 · CWE-77 pre-auth RCE Command injection	Critical9.3	—	1.9%	3 days ago
37Monitor	CVE-2026-121609No exploit	Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentialsqihoo 360 · whole home router m5 · CWE-259 Pre-auth Hard-coded credentials	Critical9.3	—	0.5%	3 days ago
28Monitor	CVE-2026-84729No exploit	Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potasus · router firmware · CWE-787 Pre-auth Memory safety	High7.2	—	0.1%	3 days ago
34Monitor	CVE-2026-84730No exploit	Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with rooasus · router firmware · CWE-121 pre-auth RCE Memory safety	High8.7	—	0.3%	3 days ago
37Monitor	CVE-2026-121615No exploit	Linksys E5600 Login mesh_login.cgi improper authenticationlinksys · e5600 · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.7%	3 days ago
30Monitor	CVE-2026-121617No exploit	Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds writelinksys · e5600 · CWE-119 Pre-auth Memory safety	High7.7	—	0.4%	3 days ago
36Monitor	CVE-2026-121802No exploit	@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), becbetter-auth · better auth · CWE-346 Pre-auth	Critical9.1	—	0.2%	3 days ago
30Monitor	CVE-2026-79405No exploit	Improper Input Validation in Modem Firmwareunisoc (shanghai) technologies co., ltd. · modem · CWE-20 Pre-auth Denial of service	High7.5	—	0.4%	3 days ago
30Monitor	CVE-2026-80335No exploit	Out-of-bounds Write in Bootloaderunisoc (shanghai) technologies co., ltd. · bootloader · CWE-787 Memory safety	High7.6	—	0.2%	3 days ago
28Monitor	CVE-2025-11229No exploit	Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Serverwso2 · wso2 identity server · CWE-269	High7.2	—	0.3%	2 days ago
30Monitor	CVE-2026-105413No exploit	Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Valuesunknown · form maker by 10web · CWE-79 Pre-auth XSS	High7.5	—	0.2%	2 days ago
28Monitor	CVE-2026-108041No exploit	SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settingsunknown · seopress · CWE-79 XSS	High7.1	—	0.2%	2 days ago
28Monitor	CVE-2026-118422No exploit	Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Pathunknown · stape conversion tracking · CWE-918 Pre-auth SSRF XSS	High7.1	—	0.1%	2 days ago
21Monitor	CVE-2026-118523Proof of concept	EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Overrideunknown · eventprime · CWE-200 Pre-auth Info leak	Medium5.3	—	0.4%	2 days ago
30Monitor	CVE-2026-11749No exploit	A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing reply corporation · armeria · CWE-294 Pre-auth Auth bypass	High7.6	—	0.2%	2 days ago
35Monitor	CVE-2026-16511No exploit	Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memoryzephyrproject · zephyr · CWE-787 Memory safety	High8.8	—	0.1%	2 days ago
40Plan	CVE-2026-77690No exploit	Command injection vulnerabilityzohocorp · manageengine key manager plus · CWE-78 RCE Command injection	High8.8	—	15.5%	2 days ago
30Monitor	CVE-2026-77779No exploit	Improper access control vulnerabilityzohocorp · manageengine key manager plus · CWE-1220	High7.7	—	0.5%	2 days ago
28Monitor	CVE-2026-87038No exploit	Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user modezephyrproject · zephyr · CWE-367 Race condition	High7.0	—	0.0%	2 days ago
31Monitor	CVE-2026-87039No exploit	I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to driverszephyrproject · zephyr · CWE-787 Memory safety	High7.8	—	0.1%	2 days ago
33Monitor	CVE-2026-87040No exploit	Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and writezephyrproject · zephyr · CWE-120 Pre-auth Memory safety	High8.3	—	0.2%	2 days ago
31Monitor	CVE-2026-87041No exploit	Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memoryzephyrproject · zephyr · CWE-125 Memory safety	High7.8	—	0.1%	2 days ago
34Monitor	CVE-2026-121816No exploit	About Time Technologies｜Herowatch Mini - Missing Authenticationabout time technologies · herowatch mini · CWE-306 Pre-auth Auth bypass	High8.7	—	0.3%	2 days ago
34Monitor	CVE-2026-121817No exploit	About Time Technologies｜Herowatch Go Server - Insecure Direct Object Referenceabout time technologies · herowatch go server · CWE-639 Pre-auth Broken access control (IDOR)	High8.7	—	0.4%	2 days ago
34Monitor	CVE-2026-121818No exploit	About Time Technologies｜Herowatch Go - Security Misconfigurationabout time technologies · herowatch go · CWE-1394 RCE Local privilege escalation	High8.5	—	0.1%	2 days ago
28Monitor	CVE-2026-54851No exploit	WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityawesomemotive · contact form by wpforms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
30Monitor	CVE-2026-62000No exploit	WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerabilitywc lovers · wcfm marketplace · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	2 days ago
28Monitor	CVE-2026-119366No exploit	WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerabilityadvancedcoding · wpdiscuz · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
28Monitor	CVE-2026-119477No exploit	WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerabilityjacob n. breetvelt · wp photo album plus · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
28Monitor	CVE-2026-54861No exploit	WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityaguila technologies · wp customer area · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
30Monitor	CVE-2026-56065No exploit	WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerabilitydoofinder · doofinder for woocommerce · CWE-538 Pre-auth Info leak	High7.5	—	0.2%	2 days ago
28Monitor	CVE-2026-57639No exploit	WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerabilityroland murg · wp booking system · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
28Monitor	CVE-2026-57666No exploit	WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerabilityaguila technologies · wp customer area · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
28Monitor	CVE-2026-62007No exploit	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-79 Pre-auth XSS	High7.1	—	0.1%	2 days ago
30Monitor	CVE-2026-62126No exploit	WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerabilityminiorange · saml sp single sign on · CWE-770 Pre-auth Denial of service	High7.5	—	0.2%	2 days ago
33Monitor	CVE-2026-114421No exploit	Empty initial password permits GINA account takeoverseppmail ag · seppmail secure email gateway (seg) · CWE-640 Pre-auth	High8.3	—	0.3%	2 days ago
36Monitor	CVE-2026-114424No exploit	Code execution through double evaluation in address replacement rulesseppmail ag · seppmail secure email gateway (seg) · CWE-95 pre-auth RCE	Critical9.2	—	0.2%	2 days ago
36Monitor	CVE-2026-114425No exploit	Forged LFT metadata permits arbitrary file read and deletionseppmail ag · seppmail secure email gateway (seg) · CWE-73 Pre-auth Path traversal	Critical9.2	—	0.3%	2 days ago
34Monitor	CVE-2026-114426No exploit	Pre-authentication upload parsing permits resource exhaustionseppmail ag · seppmail secure email gateway (seg) · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	2 days ago
34Monitor	CVE-2026-110022No exploit	Signed plug-in validation bypassphoenix contact · plcnext engineer · CWE-494	High8.6	—	0.1%	2 days ago
34Monitor	CVE-2026-110935No exploit	Path traversal in plug-in deploymentphoenix contact · plcnext engineer · CWE-22 Path traversal	High8.6	—	0.1%	2 days ago
33Monitor	CVE-2026-111036No exploit	Multiple vulnerabilities in Coupa’s Total Spend Management Platformcoupa · coupa total spend management platform · CWE-918 SSRF	High8.4	—	0.4%	2 days ago
29Monitor	CVE-2026-111038No exploit	Multiple vulnerabilities in Coupa’s Total Spend Management Platformcoupa · coupa total spend management platform · CWE-1236	High7.3	—	0.3%	2 days ago
28Monitor	CVE-2026-115498No exploit	Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Fieldwingerspeed · slim jetpack · CWE-79 Pre-auth XSS	High7.2	—	0.3%	2 days ago
35Monitor	CVE-2026-120422No exploit	Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code executionsogou · sogou input method · CWE-1428 pre-auth RCE	High8.9	—	0.4%	2 days ago
35Monitor	CVE-2026-120554No exploit	Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Savecarazo · import and export users and customers · CWE-863 Broken access control (IDOR)	High8.8	—	0.5%	2 days ago
28Monitor	CVE-2026-94459No exploit	IRISPowerscan Default accounts with predictable credentialsi.r.i.s s.a. · irispowerscan · CWE-1392 Pre-auth Hard-coded credentials	High7.2	—	0.1%	2 days ago
28Monitor	CVE-2026-94460No exploit	IRISPowerscan Insecure default privilege assignment for installation accounti.r.i.s s.a. · irispowerscan · CWE-276 Pre-auth	High7.2	—	0.1%	2 days ago
34Monitor	CVE-2026-100252No exploit	Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization IDapache software foundation · apache zookeeper · CWE-863 Broken access control (IDOR)	High8.6	—	0.5%	2 days ago
34Monitor	CVE-2026-100300No exploit	Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply threadapache software foundation · apache zookeeper · CWE-755 Pre-auth	High8.7	—	0.4%	2 days ago
28Monitor	CVE-2026-100302No exploit	Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handlingapache software foundation · apache zookeeper · CWE-770 Denial of service	High7.1	—	0.5%	2 days ago
34Monitor	CVE-2026-115448No exploit	Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverableapache software foundation · apache zookeeper · CWE-770 Pre-auth Denial of service	High8.7	—	0.6%	2 days ago
31Monitor	CVE-2026-59264No exploit	Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installerapache · openoffice · CWE-427	High7.8	—	0.2%	2 days ago

CVE-2026-95860
36Monitor
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
node-opcua · node-opcua3 days ago
CVE-2026-112354
37Monitor
Etrel INCH AC Charging Station Hard-coded Default Credentials
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
etrel d.o.o. · etrel inch3 days ago
CVE-2026-115541
28Monitor
HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation
HighCVSS 7.2No exploitEPSS 0%
- XSS
humhub · humhub community edition3 days ago
CVE-2026-118865
29Monitor
Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Command injection
tp-link systems inc. · archer ax3000 v23 days ago
CVE-2026-119084
36Monitor
Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
aws · amazon-redshift-jdbc-driver3 days ago
CVE-2026-120931
38Monitor
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outsi
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chrome3 days ago
CVE-2026-121614
28Monitor
Docker Sandboxes host Git executes repository-controlled programs
HighCVSS 7.1No exploitEPSS 0%
docker · docker sandboxes3 days ago
CVE-2026-22058
36Monitor
CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
netapp · storagegrid (formerly storagegrid webscale)3 days ago
CVE-2022-29966
37Monitor
Emerson Ovation Missing Authentication for Critical Functionality
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
emerson · ovation3 days ago
CVE-2022-30267
34Monitor
Emerson Ovation Insufficient Verification of Data Authenticity
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
emerson · ovation3 days ago
CVE-2026-104608
30Monitor
Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Memory safety
github · enterprise server3 days ago
CVE-2026-109836
33Monitor
The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical mem
HighCVSS 8.4No exploitEPSS 0%
alcpu · core temp3 days ago
CVE-2026-116650
30Monitor
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Command injection
tanium · threat response3 days ago
CVE-2026-116651
30Monitor
Tanium addressed an unauthorized code execution vulnerability in Threat Response.
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Command injection
tanium · threat response3 days ago
CVE-2026-120775
28Monitor
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
HighCVSS 7.2No exploitEPSS 0%
- Memory safety
tanium · deploy3 days ago
CVE-2026-121565
29Monitor
Tanium addressed an improper certificate validation vulnerability in multiple products
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
tanium · tanos3 days ago
CVE-2026-121727
34Monitor
Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
jorisvink · kore3 days ago
CVE-2026-121729
28Monitor
emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
0xdps · emailflare3 days ago
CVE-2026-121730
28Monitor
emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
0xdps · emailflare3 days ago
CVE-2026-121731
34Monitor
RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
francoisjacquet · rosariosis3 days ago
CVE-2026-114549
39Monitor
NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
nomachine · nomachine3 days ago
CVE-2026-114550
32Monitor
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
HighCVSS 8.1Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
libwebsockets · libwebsockets3 days ago
CVE-2026-118623
31Monitor
MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Deserialization
mlflow · mlflow3 days ago
CVE-2026-118627
31Monitor
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Deserialization
mlflow · mlflow3 days ago
CVE-2026-118628
32Monitor
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
mlflow · mlflow3 days ago
CVE-2026-121597
34Monitor
A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104.
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
3 days ago
CVE-2026-92185
29Monitor
Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability
HighCVSS 7.2No exploitEPSS 1%
- Pre-auth
- XXE
quest · foglight for databases3 days ago
CVE-2026-92186
35Monitor
Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Path traversal
quest · foglight for databases3 days ago
CVE-2026-92187
35Monitor
Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Path traversal
quest · foglight for databases3 days ago
CVE-2026-92188
39Monitor
Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
quest · foglight for databases3 days ago
CVE-2026-92189
39Monitor
Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Path traversal
quest · foglight for databases3 days ago
CVE-2026-92190
39Monitor
Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
quest · foglight for databases3 days ago
CVE-2026-92191
35Monitor
Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
quest · foglight for databases3 days ago
CVE-2026-92192
35Monitor
Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Path traversal
quest · foglight for databases3 days ago
CVE-2026-92194
35Monitor
Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Path traversal
quest · foglight for databases3 days ago
CVE-2026-92195
35Monitor
Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Path traversal
quest · foglight for databases3 days ago
CVE-2026-92196
28Monitor
Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability
HighCVSS 7.2No exploitEPSS 0%
- RCE
- SSTI
quest · foglight for databases3 days ago
CVE-2026-92197
35Monitor
Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Path traversal
quest · foglight for databases3 days ago
CVE-2026-92198
33Monitor
Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability
HighCVSS 8.2No exploitEPSS 2%
- Pre-auth
- XXE
quest · foglight for databases3 days ago
CVE-2026-92199
31Monitor
Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Hard-coded credentials
quest · foglight for databases3 days ago
CVE-2026-92200
31Monitor
Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
quest · foglight for databases3 days ago
CVE-2026-92211
31Monitor
Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
pixar animation studio · openusd3 days ago
CVE-2026-121598
34Monitor
TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
totolink · a950rg3 days ago
CVE-2026-121599
34Monitor
TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
totolink · a950rg3 days ago
CVE-2026-121600
34Monitor
TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
totolink · a950rg3 days ago
CVE-2026-121606
37Monitor
Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
qihoo 360 · d621-23 days ago
CVE-2026-112116
34Monitor
An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arb
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
asus · system control interface3 days ago
CVE-2026-121607
38Monitor
Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
qihoo 360 · d603-23 days ago
CVE-2026-121609
37Monitor
Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
qihoo 360 · whole home router m53 days ago
CVE-2026-84729
28Monitor
Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or pot
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Memory safety
asus · router firmware3 days ago
CVE-2026-84730
34Monitor
Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with roo
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Memory safety
asus · router firmware3 days ago
CVE-2026-121615
37Monitor
Linksys E5600 Login mesh_login.cgi improper authentication
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
linksys · e56003 days ago
CVE-2026-121617
30Monitor
Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
linksys · e56003 days ago
CVE-2026-121802
36Monitor
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), bec
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
better-auth · better auth3 days ago
CVE-2026-79405
30Monitor
Improper Input Validation in Modem Firmware
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
unisoc (shanghai) technologies co., ltd. · modem3 days ago
CVE-2026-80335
30Monitor
Out-of-bounds Write in Bootloader
HighCVSS 7.6No exploitEPSS 0%
- Memory safety
unisoc (shanghai) technologies co., ltd. · bootloader3 days ago
CVE-2025-11229
28Monitor
Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
HighCVSS 7.2No exploitEPSS 0%
wso2 · wso2 identity server2 days ago
CVE-2026-105413
30Monitor
Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · form maker by 10web2 days ago
CVE-2026-108041
28Monitor
SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings
HighCVSS 7.1No exploitEPSS 0%
- XSS
unknown · seopress2 days ago
CVE-2026-118422
28Monitor
Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SSRF
- XSS
unknown · stape conversion tracking2 days ago
CVE-2026-118523
21Monitor
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
unknown · eventprime2 days ago
CVE-2026-11749
30Monitor
A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing rep
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
ly corporation · armeria2 days ago
CVE-2026-16511
35Monitor
Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyr2 days ago
CVE-2026-77690
40Plan
Command injection vulnerability
HighCVSS 8.8No exploitEPSS 15%
- RCE
- Command injection
zohocorp · manageengine key manager plus2 days ago
CVE-2026-77779
30Monitor
Improper access control vulnerability
HighCVSS 7.7No exploitEPSS 0%
zohocorp · manageengine key manager plus2 days ago
CVE-2026-87038
28Monitor
Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode
HighCVSS 7.0No exploitEPSS 0%
- Race condition
zephyrproject · zephyr2 days ago
CVE-2026-87039
31Monitor
I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyr2 days ago
CVE-2026-87040
33Monitor
Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyr2 days ago
CVE-2026-87041
31Monitor
Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyr2 days ago
CVE-2026-121816
34Monitor
About Time Technologies｜Herowatch Mini - Missing Authentication
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
about time technologies · herowatch mini2 days ago
CVE-2026-121817
34Monitor
About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
about time technologies · herowatch go server2 days ago
CVE-2026-121818
34Monitor
About Time Technologies｜Herowatch Go - Security Misconfiguration
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
about time technologies · herowatch go2 days ago
CVE-2026-54851
28Monitor
WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
awesomemotive · contact form by wpforms2 days ago
CVE-2026-62000
30Monitor
WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wc lovers · wcfm marketplace2 days ago
CVE-2026-119366
28Monitor
WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
advancedcoding · wpdiscuz2 days ago
CVE-2026-119477
28Monitor
WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
jacob n. breetvelt · wp photo album plus2 days ago
CVE-2026-54861
28Monitor
WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
aguila technologies · wp customer area2 days ago
CVE-2026-56065
30Monitor
WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
doofinder · doofinder for woocommerce2 days ago
CVE-2026-57639
28Monitor
WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
roland murg · wp booking system2 days ago
CVE-2026-57666
28Monitor
WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
aguila technologies · wp customer area2 days ago
CVE-2026-62007
28Monitor
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unlimited elements · unlimited elements for elementor (free widgets, addons, templates)2 days ago
CVE-2026-62126
30Monitor
WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
miniorange · saml sp single sign on2 days ago
CVE-2026-114421
33Monitor
Empty initial password permits GINA account takeover
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
seppmail ag · seppmail secure email gateway (seg)2 days ago
CVE-2026-114424
36Monitor
Code execution through double evaluation in address replacement rules
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
seppmail ag · seppmail secure email gateway (seg)2 days ago
CVE-2026-114425
36Monitor
Forged LFT metadata permits arbitrary file read and deletion
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Path traversal
seppmail ag · seppmail secure email gateway (seg)2 days ago
CVE-2026-114426
34Monitor
Pre-authentication upload parsing permits resource exhaustion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
seppmail ag · seppmail secure email gateway (seg)2 days ago
CVE-2026-110022
34Monitor
Signed plug-in validation bypass
HighCVSS 8.6No exploitEPSS 0%
phoenix contact · plcnext engineer2 days ago
CVE-2026-110935
34Monitor
Path traversal in plug-in deployment
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
phoenix contact · plcnext engineer2 days ago
CVE-2026-111036
33Monitor
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
HighCVSS 8.4No exploitEPSS 0%
- SSRF
coupa · coupa total spend management platform2 days ago
CVE-2026-111038
29Monitor
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
HighCVSS 7.3No exploitEPSS 0%
coupa · coupa total spend management platform2 days ago
CVE-2026-115498
28Monitor
Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wingerspeed · slim jetpack2 days ago
CVE-2026-120422
35Monitor
Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution
HighCVSS 8.9No exploitEPSS 0%
- pre-auth RCE
sogou · sogou input method2 days ago
CVE-2026-120554
35Monitor
Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
carazo · import and export users and customers2 days ago
CVE-2026-94459
28Monitor
IRISPowerscan Default accounts with predictable credentials
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
i.r.i.s s.a. · irispowerscan2 days ago
CVE-2026-94460
28Monitor
IRISPowerscan Insecure default privilege assignment for installation account
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
i.r.i.s s.a. · irispowerscan2 days ago
CVE-2026-100252
34Monitor
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache zookeeper2 days ago
CVE-2026-100300
34Monitor
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
apache software foundation · apache zookeeper2 days ago
CVE-2026-100302
28Monitor
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
apache software foundation · apache zookeeper2 days ago
CVE-2026-115448
34Monitor
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache zookeeper2 days ago
CVE-2026-59264
31Monitor
Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer
HighCVSS 7.8No exploitEPSS 0%
apache · openoffice2 days ago