By publication date

Exploited and new serious CVEs: November 2026

1,594 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 8 of 16

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
29Monitor	CVE-2026-59268No exploit	Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF readerapache · openoffice · CWE-787 Memory safety	High7.3	—	0.2%	4 days ago
29Monitor	CVE-2026-90624No exploit	Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerabilityapache · openoffice · CWE-787 RCE Memory safety	High7.3	—	0.2%	4 days ago
29Monitor	CVE-2026-90626No exploit	Apache OpenOffice: Out-of-bounds write when importing encrypted PDF filesapache · openoffice · CWE-787 Memory safety	High7.3	—	0.2%	4 days ago
29Monitor	CVE-2026-90628No exploit	Apache OpenOffice: Stack overflow in CFF hint handlingapache · openoffice · CWE-121 Memory safety	High7.3	—	0.2%	4 days ago
29Monitor	CVE-2026-90629No exploit	Apache OpenOffice: Out of bounds memory access during WMF importapache · openoffice · CWE-787 Memory safety	High7.3	—	0.2%	4 days ago
29Monitor	CVE-2026-90634No exploit	Apache OpenOffice: Out-of-bounds write when importing encrypted PDF filesapache · openoffice · CWE-787 Memory safety	High7.3	—	0.2%	4 days ago
35Monitor	CVE-2026-104799No exploit	Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parametersrnlab · mobile builder · CWE-269	High8.8	—	0.3%	4 days ago
28Monitor	CVE-2026-97397No exploit	Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffereasywpstuff · remove google fonts – disable, block, or replace with bunny fonts for gdpr compliance · CWE-79 Pre-auth XSS	High7.2	—	0.2%	4 days ago
30Monitor	CVE-2026-118513No exploit	Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)sensiolabs · symfony · CWE-290 Auth bypass	High7.7	—	0.2%	4 days ago
28Monitor	CVE-2026-119468No exploit	WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilitynoptin newsletter team · noptin · CWE-79 Pre-auth XSS	High7.1	—	0.2%	4 days ago
39Monitor	CVE-2026-119481No exploit	WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerabilitycrocoblock · jetformbuilder · CWE-266 Pre-auth	Critical9.8	—	0.4%	4 days ago
35Monitor	CVE-2026-121144No exploit	Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile applicationtata motors · tata motors ira 2.0 · CWE-798 Pre-auth Hard-coded credentials	High8.8	—	0.3%	4 days ago
28Monitor	CVE-2026-121145No exploit	Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile applicationtata motors · tata motors ira 2.0 · CWE-346 Pre-auth	High7.1	—	0.2%	4 days ago
34Monitor	CVE-2026-121147No exploit	Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile applicationtata motors · tata motors ira 2.0 · CWE-295 Pre-auth Weak crypto	High8.5	—	0.0%	4 days ago
33Monitor	CVE-2026-121620No exploit	CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verificationcoopcycle · coopcycle-web · CWE-345 Pre-auth Auth bypass	High8.3	—	0.2%	4 days ago
36Monitor	CVE-2026-121939No exploit	Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linkingdavid-crty · databasement · CWE-290 Pre-auth Auth bypass	Critical9.2	—	0.5%	4 days ago
34Monitor	CVE-2026-121940No exploit	Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllersstonewuu · ai-fusion-video · CWE-639 Broken access control (IDOR)	High8.7	—	0.4%	4 days ago
34Monitor	CVE-2026-121941No exploit	libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysexmunt · libmt32emu · CWE-122 Memory safety	High8.5	—	0.2%	4 days ago
28Monitor	CVE-2026-121945No exploit	CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpointcoopcycle · coopcycle-web · CWE-639 Broken access control (IDOR)	High7.2	—	0.4%	4 days ago
39Monitor	CVE-2026-65555No exploit	WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerabilityuncanny owl · uncanny toolkit for learndash · CWE-266 Pre-auth	Critical9.8	—	0.4%	4 days ago
35Monitor	CVE-2026-118391No exploit	Unbounded query cache growth from interpolated JSON paths and splice lists in Ectoelixir-ecto · ecto · CWE-770 Pre-auth Denial of service	High8.9	—	0.4%	4 days ago
35Monitor	CVE-2026-121637No exploit	WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Resultswatchguard · authpoint authentication gateway · CWE-345 Pre-auth	High8.9	—	0.2%	4 days ago
36Monitor	CVE-2026-121638No exploit	WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attackswatchguard · authpoint authentication gateway · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.2%	4 days ago
36Monitor	CVE-2026-121639No exploit	WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Servicewatchguard · authpoint authentication gateway · CWE-252 Pre-auth Auth bypass	Critical9.2	—	0.6%	4 days ago
36Monitor	CVE-2026-121640No exploit	WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actionswatchguard · authpoint authentication gateway · CWE-294 Pre-auth Auth bypass	Critical9.1	—	0.4%	4 days ago
39Monitor	CVE-2026-122006Proof of concept	The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operarubyonrails · active storage · CWE-1188 Pre-auth	Critical9.8	—	0.7%	4 days ago
29Monitor	CVE-2026-122007No exploit	Oqtane Framework before 10.3.0 Broken Access Control via SettingControlleroqtane · oqtane.framework · CWE-639 Broken access control (IDOR)	High7.4	—	0.3%	4 days ago
39Monitor	CVE-2026-39430No exploit	On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls aCWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	4 days ago
28Monitor	CVE-2026-39431No exploit	On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows commCWE-77 RCE Command injection	High7.2	—	1.0%	4 days ago
30Monitor	CVE-2026-109518Proof of concept	APT RCE via hard link reusedebian · apt · CWE-62 pre-auth RCE	High7.7	—	0.9%	4 days ago
32Monitor	CVE-2026-119746No exploit	ProSoft ICX35 Login Lockout Bypass via Client-Side Cookiesprosoft technology · x35-hwc-a · CWE-307 Pre-auth	High8.2	—	0.4%	4 days ago
28Monitor	CVE-2026-121950No exploit	FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrapfreerdp · freerdp · CWE-122 Pre-auth Memory safety	High7.1	—	0.3%	4 days ago
34Monitor	CVE-2026-121951No exploit	FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Eventfreerdp · freerdp · CWE-617 Pre-auth	High8.7	—	0.4%	4 days ago
37Monitor	CVE-2026-121952No exploit	FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capabilityfreerdp · freerdp · CWE-787 Pre-auth Memory safety	Critical9.3	—	0.5%	4 days ago
37Monitor	CVE-2026-121953No exploit	FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Closefreerdp · freerdp · CWE-416 Pre-auth Memory safety	Critical9.3	—	0.5%	4 days ago
28Monitor	CVE-2026-121954No exploit	FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codecfreerdp · freerdp · CWE-787 Pre-auth Memory safety	High7.1	—	0.3%	4 days ago
34Monitor	CVE-2026-121955No exploit	FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContextfreerdp · freerdp · CWE-416 Pre-auth Memory safety	High8.7	—	0.3%	4 days ago
34Monitor	CVE-2026-121956No exploit	FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgtfreerdp · freerdp · CWE-415 Pre-auth Memory safety	High8.7	—	0.4%	4 days ago
34Monitor	CVE-2026-121957No exploit	FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Racefreerdp · freerdp · CWE-362 Pre-auth Race condition	High8.7	—	0.2%	4 days ago
34Monitor	CVE-2026-121958No exploit	FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeysfreerdp · freerdp · CWE-122 Pre-auth Memory safety	High8.7	—	0.3%	4 days ago
28Monitor	CVE-2026-121959No exploit	FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Framefreerdp · freerdp · CWE-835 Pre-auth Denial of service	High7.1	—	0.3%	4 days ago
34Monitor	CVE-2026-121960No exploit	FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequestfreerdp · freerdp · CWE-617 Pre-auth	High8.7	—	0.5%	4 days ago
32Monitor	CVE-2026-121961No exploit	FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Racefreerdp · freerdp · CWE-362 Pre-auth Race condition	High8.2	—	0.3%	4 days ago
28Monitor	CVE-2026-121962No exploit	FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Readfreerdp · freerdp · CWE-787 Pre-auth Memory safety	High7.2	—	0.3%	4 days ago
32Monitor	CVE-2026-121963No exploit	FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Closefreerdp · freerdp · CWE-362 Pre-auth Race condition	High8.2	—	0.3%	4 days ago
34Monitor	CVE-2026-121964No exploit	FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragmentfreerdp · freerdp · CWE-122 pre-auth RCE Memory safety	High8.7	—	0.5%	4 days ago
28Monitor	CVE-2026-121966No exploit	Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leaktraefik · traefik · CWE-488 Pre-auth	High7.0	—	0.3%	4 days ago
28Monitor	CVE-2026-122032No exploit	SPIP before 4.4.29 Authenticated SQL Injection via where Parameterspip · spip · CWE-89 SQL injection	High7.1	—	0.3%	4 days ago
33Monitor	CVE-2026-92704No exploit	SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process executionsharpemu · sharpemu · CWE-306 Pre-auth Auth bypass CSRF	High8.3	—	0.1%	4 days ago
28Monitor	CVE-2026-119747No exploit	GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST APIayecode ltd · payment forms, buy now buttons, and invoicing system \| getpaid · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	4 days ago
34Monitor	CVE-2026-119749No exploit	GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypassayecode ltd · payment forms, buy now buttons, and invoicing system \| getpaid · CWE-1284 Pre-auth	High8.7	—	0.3%	4 days ago
30Monitor	CVE-2026-76506No exploit	Cisco Unified Computing System Central Remote Code Execution Vulnerabilitycisco · cisco unified computing system central software · CWE-22 RCE Path traversal	High7.6	—	1.3%	4 days ago
32Monitor	CVE-2026-121971No exploit	Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path Referencessensiolabs · symfony · CWE-200 Pre-auth Info leak	High8.2	—	0.2%	4 days ago
29Monitor	CVE-2026-122118No exploit	In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strengyealink · avhub · CWE-334 Pre-auth	High7.4	—	0.2%	4 days ago
34Monitor	CVE-2026-57853No exploit	DataGerry < 3.3.0 SSTI via DocAPI Template Renderingdatagerry · datagerry · CWE-79 RCE XSS SSTI	High8.7	—	0.5%	4 days ago
37Monitor	CVE-2026-107846No exploit	bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction listbitcoinjs · bitcoinjs-lib · CWE-354 Pre-auth	Critical9.3	—	0.1%	4 days ago
37Monitor	CVE-2026-113780No exploit	ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundaryespressif · esp-idf · CWE-787 Local privilege escalation Memory safety	Critical9.3	—	0.1%	4 days ago
28Monitor	CVE-2026-113782No exploit	ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsingespressif · esp-idf · CWE-121 Pre-auth Memory safety	High7.1	—	0.2%	4 days ago
29Monitor	CVE-2026-113783No exploit	ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responsesespressif · esp-idf · CWE-121 Pre-auth Memory safety	High7.4	—	0.3%	4 days ago
35Monitor	CVE-2026-121930No exploit	Linksys WRT54GL Ping Diagnostic apply.cgi system os command injectionlinksys · wrt54gl · CWE-77 RCE Command injection	High8.5	—	2.7%	4 days ago
35Monitor	CVE-2026-121931No exploit	Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injectionlinksys · wrt54gl · CWE-77 RCE Command injection	High8.5	—	2.7%	4 days ago
38Monitor	CVE-2026-121932No exploit	Linksys E5350 apply.cgi system os command injectionlinksys · e5350 · CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.3%	4 days ago
36Monitor	CVE-2026-122120No exploit	In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be expyealink · plug-in softwares · CWE-434 pre-auth RCE File upload	Critical9.0	—	0.5%	4 days ago
32Monitor	CVE-2026-122148No exploit	In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability.yealink · meetingboard pro · CWE-602	High8.2	—	0.1%	4 days ago
28Monitor	CVE-2026-82029No exploit	Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portalinvoiceninja · invoiceninja · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	4 days ago
34Monitor	CVE-2026-82033No exploit	DeepSeek Harness Unauthenticated RPC Command Executiondeepseek-ai · deepseek-harness · CWE-306 RCE Auth bypass	High8.6	—	0.2%	4 days ago
30Monitor	CVE-2026-113370No exploit	Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Tasksonatype · nexus repository 3 · CWE-89 SQL injection	High7.7	—	0.2%	4 days ago
28Monitor	CVE-2026-113371No exploit	Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrasesonatype · nexus repository 3 · CWE-522 Info leak	High7.1	—	0.2%	4 days ago
28Monitor	CVE-2026-113372No exploit	Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Keysonatype · nexus repository 3 · CWE-522 Info leak	High7.1	—	0.2%	4 days ago
36Monitor	CVE-2026-113373No exploit	Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Againsonatype · nexus repository 3 · CWE-1390 Pre-auth Auth bypass	Critical9.1	—	0.2%	4 days ago
34Monitor	CVE-2026-113374No exploit	Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creationsonatype · nexus repository 3 · CWE-862 Broken access control (IDOR)	High8.6	—	0.2%	4 days ago
21Monitor	CVE-2026-115574Proof of concept	Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channelszulip · zulip · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.7%	4 days ago
37Monitor	CVE-2026-121933No exploit	Linksys E5350 Setup Wizard apply.cgi save_settings missing authenticationlinksys · e5350 · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.9%	4 days ago
28Monitor	CVE-2026-122192No exploit	Guest access to Firecracker process memory after a failed memory discardaws · firecracker · CWE-390 Local privilege escalation	High7.1	—	0.1%	4 days ago
36Monitor	CVE-2026-122220No exploit	WPO365 LOGIN before 45.2 SAML Replay Protection Bypasswpo365 · wpo365 \| seamless wordpress + microsoft integration (wpo365 \| login) · CWE-294 Pre-auth Auth bypass	Critical9.1	—	0.3%	4 days ago
30Monitor	CVE-2026-97705No exploit	Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parsermoleculerjs · moleculer · CWE-835 Pre-auth Denial of service	High7.5	—	0.3%	4 days ago
34Monitor	CVE-2025-71456No exploit	vtenext before 25.02.2 SQL Injection via fieldname in Fax EditViewvtenext · vtenext · CWE-89 SQL injection	High8.6	—	0.2%	4 days ago
37Monitor	CVE-2025-71457No exploit	vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.phpvtenext · vtenext · CWE-620 Pre-auth Auth bypass	Critical9.3	—	0.4%	4 days ago
32Monitor	CVE-2026-102339No exploit	Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackabletelepresenceio · telepresence · CWE-639 Broken access control (IDOR)	High8.2	—	0.2%	4 days ago
34Monitor	CVE-2026-102340No exploit	Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secretstelepresenceio · telepresence · CWE-306 Auth bypass	High8.5	—	0.2%	4 days ago
28Monitor	CVE-2026-102664No exploit	ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib pathsysown · proxysql · CWE-908 Memory safety	High7.1	—	0.3%	4 days ago
30Monitor	CVE-2026-104203No exploit	Traccar: Authentication bypass via path parameters exposes protected device mediatraccar · traccar · CWE-200 Pre-auth Auth bypass Info leak	High7.5	—	0.7%	4 days ago
30Monitor	CVE-2026-10859No exploit	IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerabilityibm · mq RCE Deserialization	High7.5	—	0.3%	4 days ago
32Monitor	CVE-2026-115758No exploit	SumatraPDF: TLS hostname validation disabled in `HttpGet()`sumatrapdfreader · sumatrapdf · CWE-297 Pre-auth Weak crypto	High8.2	—	0.1%	4 days ago
35Monitor	CVE-2026-11376No exploit	IBM MQ is affected by a denial of service vulnerabilityibm · mq · CWE-190 RCE Memory safety	High8.8	—	0.3%	4 days ago
34Monitor	CVE-2026-11724No exploit	IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerabilityibm · mq · CWE-20 RCE	High8.5	—	0.2%	4 days ago
28Monitor	CVE-2026-121968No exploit	Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packetsquozl · netrek-client-cow · CWE-129 Pre-auth	High7.1	—	0.3%	4 days ago
28Monitor	CVE-2026-121969No exploit	netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessagequozl · netrek-client-cow · CWE-121 Pre-auth Memory safety	High7.1	—	0.3%	4 days ago
37Monitor	CVE-2026-122013No exploit	Comfast CF-WR632AX Multipart webmgnt path traversalcomfast · cf-wr632ax · CWE-22 Pre-auth Path traversal	Critical9.3	—	0.8%	4 days ago
32Monitor	CVE-2026-122126No exploit	reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocketresiprocate · resiprocate · CWE-122 Pre-auth Memory safety	High8.2	—	0.3%	4 days ago
34Monitor	CVE-2026-122127No exploit	CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decodercesnet · ipfixcol2 · CWE-787 Pre-auth Memory safety	High8.7	—	0.3%	4 days ago
33Monitor	CVE-2026-122130No exploit	CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugincesnet · ipfixcol2 · CWE-190 Pre-auth Memory safety	High8.3	—	0.3%	4 days ago
34Monitor	CVE-2026-122133No exploit	Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exemistralai · mistral-vibe · CWE-427 pre-auth RCE	High8.6	—	0.3%	4 days ago
34Monitor	CVE-2026-122134No exploit	Mistral Vibe before 2.25.7 Code Execution via Git Filter Driversmistralai · mistral-vibe · CWE-829 pre-auth RCE	High8.6	—	0.4%	4 days ago
34Monitor	CVE-2026-122135No exploit	Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.programmistralai · mistral-vibe · CWE-829 pre-auth RCE	High8.6	—	0.4%	4 days ago
28Monitor	CVE-2026-122224No exploit	WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpointsretspen · webvirtcloud · CWE-862 Broken access control (IDOR)	High7.2	—	0.3%	4 days ago
30Monitor	CVE-2026-12356No exploit	IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerabilityibm · mq · CWE-74 RCE	High7.5	—	0.3%	4 days ago
32Monitor	CVE-2026-13271No exploit	IBM MQ Managed File Transfer is affected by a denial of service vulnerabilityibm · mq · CWE-611 XXE	High8.1	—	0.2%	4 days ago
28Monitor	CVE-2026-13284No exploit	IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 XXE	High7.1	—	0.3%	4 days ago
28Monitor	CVE-2026-13289No exploit	IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 XXE	High7.1	—	0.3%	4 days ago

CVE-2026-59268
29Monitor
Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apache · openoffice4 days ago
CVE-2026-90624
29Monitor
Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Memory safety
apache · openoffice4 days ago
CVE-2026-90626
29Monitor
Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apache · openoffice4 days ago
CVE-2026-90628
29Monitor
Apache OpenOffice: Stack overflow in CFF hint handling
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apache · openoffice4 days ago
CVE-2026-90629
29Monitor
Apache OpenOffice: Out of bounds memory access during WMF import
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apache · openoffice4 days ago
CVE-2026-90634
29Monitor
Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apache · openoffice4 days ago
CVE-2026-104799
35Monitor
Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters
HighCVSS 8.8No exploitEPSS 0%
rnlab · mobile builder4 days ago
CVE-2026-97397
28Monitor
Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
easywpstuff · remove google fonts – disable, block, or replace with bunny fonts for gdpr compliance4 days ago
CVE-2026-118513
30Monitor
Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
HighCVSS 7.7No exploitEPSS 0%
- Auth bypass
sensiolabs · symfony4 days ago
CVE-2026-119468
28Monitor
WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
noptin newsletter team · noptin4 days ago
CVE-2026-119481
39Monitor
WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
crocoblock · jetformbuilder4 days ago
CVE-2026-121144
35Monitor
Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
tata motors · tata motors ira 2.04 days ago
CVE-2026-121145
28Monitor
Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
tata motors · tata motors ira 2.04 days ago
CVE-2026-121147
34Monitor
Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
tata motors · tata motors ira 2.04 days ago
CVE-2026-121620
33Monitor
CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
coopcycle · coopcycle-web4 days ago
CVE-2026-121939
36Monitor
Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
david-crty · databasement4 days ago
CVE-2026-121940
34Monitor
Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
stonewuu · ai-fusion-video4 days ago
CVE-2026-121941
34Monitor
libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
munt · libmt32emu4 days ago
CVE-2026-121945
28Monitor
CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
coopcycle · coopcycle-web4 days ago
CVE-2026-65555
39Monitor
WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
uncanny owl · uncanny toolkit for learndash4 days ago
CVE-2026-118391
35Monitor
Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Denial of service
elixir-ecto · ecto4 days ago
CVE-2026-121637
35Monitor
WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
watchguard · authpoint authentication gateway4 days ago
CVE-2026-121638
36Monitor
WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
watchguard · authpoint authentication gateway4 days ago
CVE-2026-121639
36Monitor
WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
watchguard · authpoint authentication gateway4 days ago
CVE-2026-121640
36Monitor
WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
watchguard · authpoint authentication gateway4 days ago
CVE-2026-122006
39Monitor
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write opera
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
rubyonrails · active storage4 days ago
CVE-2026-122007
29Monitor
Oqtane Framework before 10.3.0 Broken Access Control via SettingController
HighCVSS 7.4No exploitEPSS 0%
- Broken access control (IDOR)
oqtane · oqtane.framework4 days ago
CVE-2026-39430
39Monitor
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls a
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
4 days ago
CVE-2026-39431
28Monitor
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows comm
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Command injection
4 days ago
CVE-2026-109518
30Monitor
APT RCE via hard link reuse
HighCVSS 7.7Proof of conceptEPSS 0%
- pre-auth RCE
debian · apt4 days ago
CVE-2026-119746
32Monitor
ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
prosoft technology · x35-hwc-a4 days ago
CVE-2026-121950
28Monitor
FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121951
34Monitor
FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
freerdp · freerdp4 days ago
CVE-2026-121952
37Monitor
FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121953
37Monitor
FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121954
28Monitor
FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121955
34Monitor
FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121956
34Monitor
FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121957
34Monitor
FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Race condition
freerdp · freerdp4 days ago
CVE-2026-121958
34Monitor
FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121959
28Monitor
FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
freerdp · freerdp4 days ago
CVE-2026-121960
34Monitor
FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
freerdp · freerdp4 days ago
CVE-2026-121961
32Monitor
FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Race condition
freerdp · freerdp4 days ago
CVE-2026-121962
28Monitor
FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121963
32Monitor
FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Race condition
freerdp · freerdp4 days ago
CVE-2026-121964
34Monitor
FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Memory safety
freerdp · freerdp4 days ago
CVE-2026-121966
28Monitor
Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
traefik · traefik4 days ago
CVE-2026-122032
28Monitor
SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
spip · spip4 days ago
CVE-2026-92704
33Monitor
SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
sharpemu · sharpemu4 days ago
CVE-2026-119747
28Monitor
GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
ayecode ltd · payment forms, buy now buttons, and invoicing system | getpaid4 days ago
CVE-2026-119749
34Monitor
GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
ayecode ltd · payment forms, buy now buttons, and invoicing system | getpaid4 days ago
CVE-2026-76506
30Monitor
Cisco Unified Computing System Central Remote Code Execution Vulnerability
HighCVSS 7.6No exploitEPSS 1%
- RCE
- Path traversal
cisco · cisco unified computing system central software4 days ago
CVE-2026-121971
32Monitor
Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
sensiolabs · symfony4 days ago
CVE-2026-122118
29Monitor
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient streng
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
yealink · avhub4 days ago
CVE-2026-57853
34Monitor
DataGerry < 3.3.0 SSTI via DocAPI Template Rendering
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
- SSTI
datagerry · datagerry4 days ago
CVE-2026-107846
37Monitor
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
bitcoinjs · bitcoinjs-lib4 days ago
CVE-2026-113780
37Monitor
ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
CriticalCVSS 9.3No exploitEPSS 0%
- Local privilege escalation
- Memory safety
espressif · esp-idf4 days ago
CVE-2026-113782
28Monitor
ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
espressif · esp-idf4 days ago
CVE-2026-113783
29Monitor
ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Memory safety
espressif · esp-idf4 days ago
CVE-2026-121930
35Monitor
Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
linksys · wrt54gl4 days ago
CVE-2026-121931
35Monitor
Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
linksys · wrt54gl4 days ago
CVE-2026-121932
38Monitor
Linksys E5350 apply.cgi system os command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
linksys · e53504 days ago
CVE-2026-122120
36Monitor
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exp
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
- File upload
yealink · plug-in softwares4 days ago
CVE-2026-122148
32Monitor
In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability.
HighCVSS 8.2No exploitEPSS 0%
yealink · meetingboard pro4 days ago
CVE-2026-82029
28Monitor
Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
invoiceninja · invoiceninja4 days ago
CVE-2026-82033
34Monitor
DeepSeek Harness Unauthenticated RPC Command Execution
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Auth bypass
deepseek-ai · deepseek-harness4 days ago
CVE-2026-113370
30Monitor
Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
HighCVSS 7.7No exploitEPSS 0%
- SQL injection
sonatype · nexus repository 34 days ago
CVE-2026-113371
28Monitor
Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
HighCVSS 7.1No exploitEPSS 0%
- Info leak
sonatype · nexus repository 34 days ago
CVE-2026-113372
28Monitor
Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
HighCVSS 7.1No exploitEPSS 0%
- Info leak
sonatype · nexus repository 34 days ago
CVE-2026-113373
36Monitor
Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
sonatype · nexus repository 34 days ago
CVE-2026-113374
34Monitor
Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
sonatype · nexus repository 34 days ago
CVE-2026-115574
21Monitor
Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
zulip · zulip4 days ago
CVE-2026-121933
37Monitor
Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
linksys · e53504 days ago
CVE-2026-122192
28Monitor
Guest access to Firecracker process memory after a failed memory discard
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
aws · firecracker4 days ago
CVE-2026-122220
36Monitor
WPO365 LOGIN before 45.2 SAML Replay Protection Bypass
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
wpo365 · wpo365 | seamless wordpress + microsoft integration (wpo365 | login)4 days ago
CVE-2026-97705
30Monitor
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
moleculerjs · moleculer4 days ago
CVE-2025-71456
34Monitor
vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
vtenext · vtenext4 days ago
CVE-2025-71457
37Monitor
vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
vtenext · vtenext4 days ago
CVE-2026-102339
32Monitor
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable
HighCVSS 8.2No exploitEPSS 0%
- Broken access control (IDOR)
telepresenceio · telepresence4 days ago
CVE-2026-102340
34Monitor
Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
telepresenceio · telepresence4 days ago
CVE-2026-102664
28Monitor
ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
sysown · proxysql4 days ago
CVE-2026-104203
30Monitor
Traccar: Authentication bypass via path parameters exposes protected device media
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Info leak
traccar · traccar4 days ago
CVE-2026-10859
30Monitor
IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Deserialization
ibm · mq4 days ago
CVE-2026-115758
32Monitor
SumatraPDF: TLS hostname validation disabled in `HttpGet()`
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
sumatrapdfreader · sumatrapdf4 days ago
CVE-2026-11376
35Monitor
IBM MQ is affected by a denial of service vulnerability
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Memory safety
ibm · mq4 days ago
CVE-2026-11724
34Monitor
IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
HighCVSS 8.5No exploitEPSS 0%
- RCE
ibm · mq4 days ago
CVE-2026-121968
28Monitor
Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
quozl · netrek-client-cow4 days ago
CVE-2026-121969
28Monitor
netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
quozl · netrek-client-cow4 days ago
CVE-2026-122013
37Monitor
Comfast CF-WR632AX Multipart webmgnt path traversal
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Path traversal
comfast · cf-wr632ax4 days ago
CVE-2026-122126
32Monitor
reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
resiprocate · resiprocate4 days ago
CVE-2026-122127
34Monitor
CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
cesnet · ipfixcol24 days ago
CVE-2026-122130
33Monitor
CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
cesnet · ipfixcol24 days ago
CVE-2026-122133
34Monitor
Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
mistralai · mistral-vibe4 days ago
CVE-2026-122134
34Monitor
Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
mistralai · mistral-vibe4 days ago
CVE-2026-122135
34Monitor
Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
mistralai · mistral-vibe4 days ago
CVE-2026-122224
28Monitor
WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
retspen · webvirtcloud4 days ago
CVE-2026-12356
30Monitor
IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
HighCVSS 7.5No exploitEPSS 0%
- RCE
ibm · mq4 days ago
CVE-2026-13271
32Monitor
IBM MQ Managed File Transfer is affected by a denial of service vulnerability
HighCVSS 8.1No exploitEPSS 0%
- XXE
ibm · mq4 days ago
CVE-2026-13284
28Monitor
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
HighCVSS 7.1No exploitEPSS 0%
- XXE
ibm · mq4 days ago
CVE-2026-13289
28Monitor
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
HighCVSS 7.1No exploitEPSS 0%
- XXE
ibm · mq4 days ago