Trending vulnerabilities
What changed in the last 30 days: vulnerabilities newly added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and new records with a high exploit-prediction score (EPSS) that are not in KEV. 8 entries were added to KEV in the last 7 days.
Added to CISA's KEV catalog, last 30 days
- CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
- CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
- CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
- CVE-2026-109618 PHP Memory Corruption Vulnerability
- CVE-2026-109619 PHP Stale Internal Request-State Vulnerability
- CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
- CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability
- CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
- CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability
- CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability
- CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
- CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
- CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability
- CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability
- CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
- CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability
- CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
- CVE-2015-5477 ISC BIND Data Processing Errors Vulnerability
- CVE-2015-3306 ProFTPD Improper Access Control Vulnerability
- CVE-2016-3081 Apache Struts Command Injection Vulnerability
- CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability
- CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability
- CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability
- CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability
- CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
- CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Newest critical records, last 3 days
Records with a CVSS score of 9.0 or higher that are not in CISA's KEV catalog, newest first. EPSS and CISA's proof-of-concept assessment are shown when they exist; a record from the last day or two may have neither yet.
- CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection
- CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust
- CVE-2026-44179 XWiki Pro Macros: excerpt-include title and content injection executes code
- CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
- CVE-2026-103409 Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
- CVE-2026-103688 Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
- CVE-2026-103780 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 throug…
- CVE-2026-106013 Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
- CVE-2026-109218 Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
- CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
- CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
- CVE-2026-115968 WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
- CVE-2026-84999 Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
- CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 throug…
- CVE-2026-86397 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 throug…
- CVE-2026-86400 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 throug…
- CVE-2026-103792 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versio…
- CVE-2026-103799 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versio…
- CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue
- CVE-2026-104383 Code injection in EagleCloud Aquila on-premises version
- CVE-2026-105420 Path Traversal in Wing WFTP Server leading to Remote Code Execution
- CVE-2026-112197 Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
- CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
- CVE-2026-111411 WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
- CVE-2026-115607 WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability
Source: CVE List V5 (CVE Program), cve_2026-10-29_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
New records with a high exploit probability, last 30 days
EPSS is the probability that a vulnerability is exploited in the next 30 days, as estimated by FIRST's model; it is not a verdict. These records are not in CISA's KEV catalog. Shown from an EPSS of 10%.
- CVE-2026-59774 Gitea Org-mode file disclosure and code execution
- CVE-2026-97229 Integer Overflow or Wraparound in GitLab
- CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
- CVE-2026-93674 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
Source: CVE List V5 (CVE Program), cve_2026-10-29_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
See also every exploited vulnerability, the KEV catalog by month and vendor and the Atom feed of new KEV additions.