Watchlist: not in KEV yet

Recent vulnerabilities that CISA has not added to its Known Exploited Vulnerabilities (KEV) catalog, but that show a high exploit probability or an early sign of exploitation. A probability or a proof of concept is not a report of exploitation.

62with a high exploit probabilityEPSS of 10% or more, published in the last 180 days
241new critical records with a signalCVSS 9.0+, last 30 days, public proof of concept or EPSS of 3% or more

Source: FIRST EPSS, as of 29 Oct 2026; CVE List, as of 29 Oct 2026; CISA KEV 2026.10.28, as of 28 Oct 2026. About the data.

High exploit probability

EPSS is FIRST's estimated probability that a vulnerability is exploited in the next 30 days. Highest score first.

CVE-2026-43284 xfrm: esp: avoid in-place decrypt on shared skb fragsLinux · Published 8 May 2026 · CVSS 8.8 · EPSS 94.2% · Public PoC (CISA)
CVE-2026-43500 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are presentLinux · Published 11 May 2026 · CVSS 7.8 · EPSS 94.1%
CVE-2026-41089 Windows Netlogon Remote Code Execution VulnerabilityMicrosoft · Published 12 May 2026 · CVSS 9.8 · EPSS 79.6%
CVE-2026-42945 NGINX ngx_http_rewrite_module vulnerabilityF5 · Published 13 May 2026 · CVSS 9.2 · EPSS 68%
CVE-2026-49160 HTTP.sys Denial of Service VulnerabilityMicrosoft · Published 9 Jun 2026 · CVSS 7.5 · EPSS 56.6%
CVE-2026-10523 An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions al…Ivanti · Published 9 Jun 2026 · CVSS 9.9 · EPSS 53.1%
CVE-2026-53435 In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbit…Jenkins · Published 10 Jun 2026 · CVSS 8.8 · EPSS 53.1%
CVE-2026-23918 Apache HTTP Server: http2: double free and possible RCE on early resetApache · Published 4 May 2026 · CVSS 8.8 · EPSS 49.7%
CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeFlowiseAI · Published 8 Jun 2026 · CVSS 9.4 · EPSS 36.3% · Public PoC (CISA)
CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgradesvercel · Published 13 May 2026 · CVSS 8.6 · EPSS 35.5%
CVE-2026-45484 Microsoft SharePoint Elevation of Privilege VulnerabilityMicrosoft · Published 9 Jun 2026 · CVSS 8.8 · EPSS 35.2%
CVE-2026-49975 Apache HTTP Server: mod_http2 denial of serviceApache · Published 8 Jun 2026 · CVSS 7.5 · EPSS 33% · Public PoC (CISA)
CVE-2026-44338 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionMervinPraison · Published 8 May 2026 · CVSS 7.3 · EPSS 32.6% · Public PoC (CISA)
CVE-2026-0826 Poly Voice – Possible Remote Control of Certain Poly DevicesHP · Published 1 Jun 2026 · CVSS 9.2 · EPSS 32.2%
CVE-2026-20251 Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure GatewaySplunk · Published 10 Jun 2026 · CVSS 8.8 · EPSS 32.2%

Show 47 more

CVE-2026-33112 Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft · Published 12 May 2026 · CVSS 8.8 · EPSS 31.1%
CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingRails · Published 30 Jul 2026 · CVSS 9.5 · EPSS 30.1% · Public PoC (CISA)
CVE-2026-59774 Gitea Org-mode file disclosure and code executionGitea · Published 14 Oct 2026 · CVSS 9.8 · EPSS 28.3%
CVE-2026-47291 HTTP.sys Remote Code Execution VulnerabilityMicrosoft · Published 9 Jun 2026 · CVSS 9.8 · EPSS 25.3%
CVE-2026-49373 In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settingsJetBrains · Published 29 May 2026 · CVSS 7.1 · EPSS 24.9%
CVE-2026-34474 Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6.Published 6 May 2026 · CVSS 7.5 · EPSS 24.7%
CVE-2026-41948 Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Accesslanggenius · Published 18 May 2026 · CVSS 9.3 · EPSS 22.7% · Public PoC (CISA)
CVE-2026-34648 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe · Published 12 May 2026 · CVSS 7.5 · EPSS 21.4%
CVE-2026-45434 Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCEApache · Published 19 May 2026 · CVSS 9.8 · EPSS 21.3%
CVE-2026-2652 Authentication Bypass in mlflow/mlflowMLflow · Published 15 May 2026 · CVSS 8.6 · EPSS 20.8% · Public PoC (CISA)
CVE-2026-8732 WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Actionflippercode · Published 29 May 2026 · CVSS 9.8 · EPSS 20.4%
CVE-2026-36356 The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthent…Published 5 May 2026 · CVSS 9.1 · EPSS 20.3% · Public PoC (CISA)
CVE-2026-45502 Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft · Published 9 Jun 2026 · CVSS 5.0 · EPSS 20.3%
CVE-2026-47323 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringApache · Published 19 May 2026 · CVSS 9.8 · EPSS 19.6%
CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slashXWiki · Published 20 May 2026 · CVSS 9.3 · EPSS 18.5%
CVE-2026-97229 Integer Overflow or Wraparound in GitLabGitLab · Published 13 Oct 2026 · CVSS 10.0 · EPSS 18.4%
CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI GatewayGitLab · Published 2 Oct 2026 · CVSS 9.9 · EPSS 17.5%
CVE-2026-9440 Edimax BR-6478AC POST Request formAccept command injectionEdimax · Published 25 May 2026 · CVSS 5.3 · EPSS 16.6% · Public PoC (CISA)
CVE-2026-7864 Exposure of Sensitive Information to an Unauthorized ActorSEPPmail · Published 8 May 2026 · CVSS 6.9 · EPSS 16.1%
CVE-2026-45657 Windows Kernel Remote Code Execution VulnerabilityMicrosoft · Published 9 Jun 2026 · CVSS 9.8 · EPSS 15.5%
CVE-2026-93674 Langflow OSS is affected by multiple vulnerabilitiesIBM · Published 7 Oct 2026 · CVSS 9.8 · EPSS 15.3%
CVE-2026-61447 PraisonAI before 1.6.78 Remote Code Execution via CodeAgentMervinPraison · Published 11 Jul 2026 · CVSS 10.0 · EPSS 15.2% · Public PoC (CISA)
CVE-2026-45829 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an…Chroma · Published 18 May 2026 · CVSS 10.0 · EPSS 15.1% · Public PoC (CISA)
CVE-2026-34650 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe · Published 12 May 2026 · CVSS 7.5 · EPSS 15.1%
CVE-2026-9441 Edimax BR-6478AC POST Request formiNICbasic command injectionEdimax · Published 25 May 2026 · CVSS 5.3 · EPSS 15% · Public PoC (CISA)
CVE-2026-17176 OS Command Injection Vulnerability in Deco DevicesTP-Link · Published 10 Sep 2026 · CVSS 7.7 · EPSS 15%
CVE-2026-44127 Local File Inclusion (LFI) and Arbitrary File DeletionSEPPmail · Published 8 May 2026 · CVSS 8.8 · EPSS 14.8%
CVE-2026-8181 Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeoverburstbv · Published 14 May 2026 · CVSS 9.8 · EPSS 14.6%
CVE-2026-4480 Samba: samba: remote code execution in printing subsystem via unescaped job descriptionRed Hat · Published 26 May 2026 · CVSS 9.0 · EPSS 13.9%
CVE-2026-43825 Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModelApache · Published 6 Jul 2026 · CVSS 7.3 · EPSS 13.9%
CVE-2026-10727 An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote…Ivanti · Published 9 Jun 2026 · CVSS 7.2 · EPSS 13.6%
CVE-2026-34649 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe · Published 12 May 2026 · CVSS 7.5 · EPSS 13.6%
CVE-2026-35223 Joomla! Core - [20260508] - Improper access check in com_config webservice endpointsJoomla · Published 26 May 2026 · CVSS 8.6 · EPSS 12.8%
CVE-2026-40383 Joomla! Core - [20260509] - LFI in HTMLView layout parameterJoomla · Published 26 May 2026 · CVSS 7.5 · EPSS 12.5%
CVE-2026-44492 Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)axios · Published 11 Jun 2026 · CVSS 8.6 · EPSS 12.3% · Public PoC (CISA)
CVE-2026-50508 Windows NTLM Spoofing VulnerabilityMicrosoft · Published 9 Jun 2026 · CVSS 6.5 · EPSS 12.1%
CVE-2026-5786 An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a rem…Ivanti · Published 7 May 2026 · CVSS 8.8 · EPSS 11.2%
CVE-2026-50656 Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft · Published 16 Jun 2026 · CVSS 7.8 · EPSS 11.2% · Public PoC (CISA)
CVE-2026-9256 NGINX ngx_http_rewrite_module vulnerabilityF5 · Published 22 May 2026 · CVSS 9.2 · EPSS 10.9%
CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.phpNetgate · Published 15 Oct 2026 · CVSS 8.6 · EPSS 10.8% · Public PoC (CISA)
CVE-2026-9514 Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injectiontotolink · Published 25 May 2026 · CVSS 5.3 · EPSS 10.4% · Public PoC (CISA)
CVE-2026-9515 Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectiontotolink · Published 25 May 2026 · CVSS 5.3 · EPSS 10.4% · Public PoC (CISA)
CVE-2026-9531 Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injectiontotolink · Published 26 May 2026 · CVSS 5.3 · EPSS 10.4% · Public PoC (CISA)
CVE-2026-9532 Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injectiontotolink · Published 26 May 2026 · CVSS 5.3 · EPSS 10.4% · Public PoC (CISA)
CVE-2026-9533 Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injectiontotolink · Published 26 May 2026 · CVSS 5.3 · EPSS 10.4% · Public PoC (CISA)
CVE-2026-9534 Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injectiontotolink · Published 26 May 2026 · CVSS 5.3 · EPSS 10.4% · Public PoC (CISA)
CVE-2026-15733 WGDashboard Remote Code Execution vulnerabilityWGDashboard · Published 6 Aug 2026 · CVSS 9.8 · EPSS 10% · Public PoC (CISA)

Source: FIRST EPSS, as of 29 Oct 2026; CVE List, as of 29 Oct 2026. About the data.

New critical records with an exploitation signal

Records with a CVSS score of 9.0 or higher, published in the last 30 days, for which CISA's assessment in the record names a public proof of concept or exploitation, or whose EPSS is 3% or more. Newest first.

CVE-2026-107092 NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.Published 26 Oct 2026 · CVSS 9.8 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-116232 Oray Pugongying X5 Pro SNMP snmp_set crlf injectionOray · Published 26 Oct 2026 · CVSS 9.4 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injectionOray · Published 26 Oct 2026 · CVSS 9.4 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-116504 TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injectiontotolink · Published 26 Oct 2026 · CVSS 9.4 · EPSS 1.5% · Public PoC (CISA)
CVE-2021-48014 FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServerFanRuan · Published 22 Oct 2026 · CVSS 9.3 · EPSS 2% · Public PoC (CISA)
CVE-2026-114575 TOTOLINK A950RG product.so UploadCustomModule command injectiontotolink · Published 22 Oct 2026 · CVSS 10.0 · EPSS 2.2% · Public PoC (CISA)
CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpointsopenremote · Published 22 Oct 2026 · CVSS 9.0 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-113736 D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty passwordD-Link · Published 21 Oct 2026 · CVSS 9.3 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-113744 Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflowTenda · Published 21 Oct 2026 · CVSS 10.0 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretstriggerdotdev · Published 21 Oct 2026 · CVSS 9.2 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-114108 HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCEHKUDS · Published 21 Oct 2026 · CVSS 9.3 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-114268 Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflowTenda · Published 21 Oct 2026 · CVSS 9.4 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-114382 TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflowtotolink · Published 21 Oct 2026 · CVSS 10.0 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-114383 TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflowtotolink · Published 21 Oct 2026 · CVSS 10.0 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::loadPHPOffice · Published 21 Oct 2026 · CVSS 9.2 · EPSS 0.7% · Public PoC (CISA)

Show 226 more

CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns…OpenStack · Published 21 Oct 2026 · CVSS 9.9 · EPSS 0.5% · Public PoC (CISA)
CVE-2016-20101 Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.phpPedro Marcelo · Published 20 Oct 2026 · CVSS 9.2 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shellcas-bigdatalab · Published 20 Oct 2026 · CVSS 9.3 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-109444 OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt InjectionTracer-Cloud · Published 20 Oct 2026 · CVSS 9.3 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injectionDrayTek · Published 20 Oct 2026 · CVSS 9.4 · EPSS 1.9% · Public PoC (CISA)
CVE-2026-113390 DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injectionDrayTek · Published 20 Oct 2026 · CVSS 9.4 · EPSS 1.9% · Public PoC (CISA)
CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injectionDrayTek · Published 20 Oct 2026 · CVSS 9.4 · EPSS 2.1% · Public PoC (CISA)
CVE-2026-113506 aaPanel File Manager common.py ExecShell os command injectionPublished 20 Oct 2026 · CVSS 9.4 · EPSS 2.1% · Public PoC (CISA)
CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cronfroxlor · Published 20 Oct 2026 · CVSS 9.4 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofinggiuseppe99barchetta · Published 20 Oct 2026 · CVSS 9.1 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-113802 Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file HandlerWavlink · Published 20 Oct 2026 · CVSS 9.3 · EPSS 3.5% · Public PoC (CISA)
CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpointchatchat-space · Published 20 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-77930 EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-AgentsEvoScientist · Published 20 Oct 2026 · CVSS 9.3 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agenteosphoros-ai · Published 20 Oct 2026 · CVSS 9.3 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deploymenteosphoros-ai · Published 20 Oct 2026 · CVSS 9.3 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Accessletta-ai · Published 20 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)Google · Published 19 Oct 2026 · CVSS 9.3 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)Google · Published 19 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admi…Published 19 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-107083 SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/module…Published 19 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-109432 Camunda Expression Injection via orQueries RCECamunda · Published 19 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell BackendCognicellAI · Published 19 Oct 2026 · CVSS 9.2 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-111057 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmljar · Published 19 Oct 2026 · CVSS 10.0 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-112370 H3C Magic NX15 usrlist sub_416874 os command injectionH3C · Published 19 Oct 2026 · CVSS 9.4 · EPSS 2% · Public PoC (CISA)
CVE-2026-112371 H3C Magic NX15 RPC esps write code injectionH3C · Published 19 Oct 2026 · CVSS 9.4 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython-pillow · Published 19 Oct 2026 · CVSS 9.2 · EPSS 1% · Public PoC (CISA)
CVE-2026-112398 Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionpython-pillow · Published 19 Oct 2026 · CVSS 9.2 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-112403 Pillow: Heap buffer overflow in ImagingJpegDecodepython-pillow · Published 19 Oct 2026 · CVSS 9.2 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)Apache · Published 19 Oct 2026 · CVSS 10.0 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-111998 Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gatewayvanus-labs · Published 18 Oct 2026 · CVSS 9.3 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editorclidey · Published 18 Oct 2026 · CVSS 9.2 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injectionthorsten · Published 17 Oct 2026 · CVSS 9.3 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-111391 SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filtersgl-project · Published 16 Oct 2026 · CVSS 9.2 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-111643 Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollbackl429609201 · Published 16 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutationchaskiq · Published 16 Oct 2026 · CVSS 9.2 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-111673 IceCMS through 4.1.5 Missing Authentication via /User Administrative EndpointsThecosy · Published 16 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeoverxiaochong0302 · Published 16 Oct 2026 · CVSS 9.1 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpointrachelos · Published 16 Oct 2026 · CVSS 9.3 · EPSS 1% · Public PoC (CISA)
CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypasssuyuan32 · Published 16 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secretdatabufflabs · Published 16 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentialsdatabufflabs · Published 16 Oct 2026 · CVSS 9.3 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API ControllersLangChat · Published 16 Oct 2026 · CVSS 9.3 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signupcanove · Published 16 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session contextCountly · Published 16 Oct 2026 · CVSS 9.0 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-94169 WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerabilityThemeOne · Published 16 Oct 2026 · CVSS 10.0 · EPSS 4.4%
CVE-2026-95182 An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via sup…Published 16 Oct 2026 · CVSS 10.0 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_jsonauthlib · Published 15 Oct 2026 · CVSS 9.1 · EPSS 0.1% · Public PoC (CISA)
CVE-2026-104586 AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.Published 15 Oct 2026 · CVSS 9.8 · EPSS 1.5% · Public PoC (CISA)
CVE-2026-110957 Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injectionWavlink · Published 15 Oct 2026 · CVSS 10.0 · EPSS 3.1% · Public PoC (CISA)
CVE-2026-110958 Wavlink WN530HG4B api.cgi heap-based overflowWavlink · Published 15 Oct 2026 · CVSS 10.0 · EPSS 1% · Public PoC (CISA)
CVE-2026-111281 Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded CredentialsJooan · Published 15 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-111312 OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] RouteOpenHealthForAll · Published 15 Oct 2026 · CVSS 9.2 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-111322 Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control APIcoleam00 · Published 15 Oct 2026 · CVSS 9.3 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Consolejuggleim · Published 15 Oct 2026 · CVSS 9.3 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Forcemagicblack · Published 15 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-19863 An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path…Published 15 Oct 2026 · CVSS 9.3 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-55240 Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templatesmsgbyte · Published 15 Oct 2026 · CVSS 9.1 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importeropnsense · Published 15 Oct 2026 · CVSS 9.9 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token RedactionLabs64 · Published 15 Oct 2026 · CVSS 9.6 · EPSS 0.4% · Public PoC (CISA)
CVE-2020-37282 office-converter through 1.0.2 OS Command Injection via fileName in generatePdfvworld4u · Published 14 Oct 2026 · CVSS 9.3 · EPSS 3.4% · Public PoC (CISA)
CVE-2026-101967 Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is usedJuniper · Published 14 Oct 2026 · CVSS 9.3 · EPSS 3.9%
CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijackinghestiacp · Published 14 Oct 2026 · CVSS 9.9 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-110536 D-Link DIR-868L HNAP CGI cgibin system os command injectionD-Link · Published 14 Oct 2026 · CVSS 10.0 · EPSS 2.9% · Public PoC (CISA)
CVE-2026-110612 vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtilwwwlike · Published 14 Oct 2026 · CVSS 9.3 · EPSS 1% · Public PoC (CISA)
CVE-2026-110616 NullHub through 2026.5.29 Missing Authentication for /api Management APInullclaw · Published 14 Oct 2026 · CVSS 9.2 · EPSS 1% · Public PoC (CISA)
CVE-2026-110631 Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configurationmoghtech · Published 14 Oct 2026 · CVSS 9.3 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-110632 Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCEReport One · Published 14 Oct 2026 · CVSS 9.2 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Pathsrevolunet · Published 14 Oct 2026 · CVSS 9.3 · EPSS 2.7% · Public PoC (CISA)
CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()ArsalanDotMe · Published 14 Oct 2026 · CVSS 9.3 · EPSS 3.2% · Public PoC (CISA)
CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Pathsanshulkharb · Published 14 Oct 2026 · CVSS 9.3 · EPSS 3% · Public PoC (CISA)
CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chaine107inc · Published 14 Oct 2026 · CVSS 9.8 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-55683 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.phpLabRedesCefetRJ · Published 14 Oct 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external accessgetredash · Published 14 Oct 2026 · CVSS 9.3 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationkedacore · Published 14 Oct 2026 · CVSS 9.9 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2Stirling-Tools · Published 14 Oct 2026 · CVSS 9.1 · EPSS 3.4% · Public PoC (CISA)
CVE-2026-103849 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Adobe · Published 13 Oct 2026 · CVSS 10.0 · EPSS 1.2% · Public PoC (CISA)
CVE-2026-104584 reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS…Published 13 Oct 2026 · CVSS 9.8 · EPSS 1.6% · Public PoC (CISA)
CVE-2026-104585 Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic…Published 13 Oct 2026 · CVSS 9.8 · EPSS 1.4% · Public PoC (CISA)
CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM…Fortinet · Published 13 Oct 2026 · CVSS 9.4 · EPSS 1% · Public PoC (CISA)
CVE-2026-108971 D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verificationD-Link · Published 13 Oct 2026 · CVSS 9.4 · EPSS 0.2% · Public PoC (CISA)
CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injectionWavlink · Published 13 Oct 2026 · CVSS 10.0 · EPSS 2% · Public PoC (CISA)
CVE-2026-109157 TRENDnet TEW-432BRP formTcpipSetup stack-based overflowTRENDnet · Published 13 Oct 2026 · CVSS 9.4 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-109520 Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actionsColorful · Published 13 Oct 2026 · CVSS 9.3 · EPSS 0.1% · Public PoC (CISA)
CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset CheckFinsys · Published 13 Oct 2026 · CVSS 10.0 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-37107 An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php…Published 13 Oct 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-52394 DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.Published 13 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryIBM · Published 13 Oct 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-55183 RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web PageZarestia-Dev · Published 13 Oct 2026 · CVSS 9.6 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name fieldjhuckaby · Published 13 Oct 2026 · CVSS 9.0 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secretssaltyorg · Published 13 Oct 2026 · CVSS 10.0 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-55695 FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updaterfearlessgeekmedia · Published 13 Oct 2026 · CVSS 9.1 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-74040 Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_workerWazuh · Published 13 Oct 2026 · CVSS 9.4 · EPSS 0.7% · Public PoC (CISA)
CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge functionkaruppiah7890 · Published 12 Oct 2026 · CVSS 9.2 · EPSS 1.9% · Public PoC (CISA)
CVE-2026-108804 TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injectionTRENDnet · Published 12 Oct 2026 · CVSS 10.0 · EPSS 2.3% · Public PoC (CISA)
CVE-2026-108892 Linksys E1700 Mac Filter ssid1MACFilter stack-based overflowLinksys · Published 12 Oct 2026 · CVSS 10.0 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-108893 Linksys E1700 setVlan stack-based overflowLinksys · Published 12 Oct 2026 · CVSS 9.4 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-108894 Linksys E1700 Static Route addStaticRoute os command injectionLinksys · Published 12 Oct 2026 · CVSS 9.4 · EPSS 2.2% · Public PoC (CISA)
CVE-2026-108895 Linksys E1700 setDMZ os command injectionLinksys · Published 12 Oct 2026 · CVSS 9.4 · EPSS 2.2% · Public PoC (CISA)
CVE-2026-108896 Linksys E1700 setLinksysIpv6 os command injectionLinksys · Published 12 Oct 2026 · CVSS 9.4 · EPSS 2.2% · Public PoC (CISA)
CVE-2026-108907 Netcore NR268 CGI Execution user_ok improper authenticationNetcore · Published 12 Oct 2026 · CVSS 10.0 · EPSS 1.2% · Public PoC (CISA)
CVE-2026-108914 Edimax BR-6208AC formWlSiteSurvey buffer overflowEdimax · Published 12 Oct 2026 · CVSS 9.4 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-108915 Edimax BR-6208AC formWlanMP buffer overflowEdimax · Published 12 Oct 2026 · CVSS 9.4 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-108917 Edimax BR-6208AC formAutoFWupgrade command injectionEdimax · Published 12 Oct 2026 · CVSS 10.0 · EPSS 2% · Public PoC (CISA)
CVE-2026-108918 Edimax BR-6208AC formWlanMP command injectionEdimax · Published 12 Oct 2026 · CVSS 10.0 · EPSS 2% · Public PoC (CISA)
CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Headerlibrenms · Published 12 Oct 2026 · CVSS 9.2 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-109390 AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overfl…AnyDesk · Published 12 Oct 2026 · CVSS 9.8 · EPSS 1.6% · Public PoC (CISA)
CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkoutthirty bees · Published 12 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpointthorsten · Published 12 Oct 2026 · CVSS 9.2 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-57118 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpointsMervinPraison · Published 12 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-108540 OpenSpug File Transfer transfer os command injectionOpenSpug · Published 11 Oct 2026 · CVSS 9.4 · EPSS 1.7% · Public PoC (CISA)
CVE-2026-108576 TOZED X300 IPPingDiagnostics process_ping os command injectionTOZED · Published 11 Oct 2026 · CVSS 10.0 · EPSS 4.1%
CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspectWuKongOpenSource · Published 11 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Composeagnaistic · Published 11 Oct 2026 · CVSS 9.3 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templatesfloci-io · Published 10 Oct 2026 · CVSS 9.3 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite0xJacky · Published 9 Oct 2026 · CVSS 9.4 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-108107 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.phphotspotbilling · Published 9 Oct 2026 · CVSS 9.3 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-108109 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Codehotspotbilling · Published 9 Oct 2026 · CVSS 9.3 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmenttinacms · Published 9 Oct 2026 · CVSS 9.3 · EPSS 0.2% · Public PoC (CISA)
CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)wizarrrr · Published 9 Oct 2026 · CVSS 9.1 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-78796 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allow…Published 9 Oct 2026 · CVSS 9.8 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id i…Published 9 Oct 2026 · CVSS 9.8 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.Published 9 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-105110 Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI ParameterIskratel · Published 8 Oct 2026 · CVSS 9.3 · EPSS 3% · Public PoC (CISA)
CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset APIIntegrics · Published 8 Oct 2026 · CVSS 9.3 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-107700 dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argumentntharim · Published 8 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertToenmaso · Published 8 Oct 2026 · CVSS 9.3 · EPSS 1.8% · Public PoC (CISA)
CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_formatjtescher · Published 8 Oct 2026 · CVSS 9.3 · EPSS 2% · Public PoC (CISA)
CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionnearform · Published 8 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-85097 Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' ParameterBricksforge · Published 8 Oct 2026 · CVSS 9.8 · EPSS 3.3%
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspxmJob · Published 8 Oct 2026 · CVSS 9.3 · EPSS 0.7% · Public PoC (CISA)
CVE-2025-64393 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the ba…Veeam · Published 7 Oct 2026 · CVSS 9.4 · EPSS 5.2%
CVE-2025-70518 The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied…Published 7 Oct 2026 · CVSS 10.0 · EPSS 0.6% · Public PoC (CISA)
CVE-2025-70520 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions a…Published 7 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script EndpointLMCache · Published 7 Oct 2026 · CVSS 9.3 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationMervinPraison · Published 7 Oct 2026 · CVSS 9.1 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Loginsipcapture · Published 7 Oct 2026 · CVSS 9.8 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)sipcapture · Published 7 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk EnterpriseSplunk · Published 7 Oct 2026 · CVSS 9.8 · EPSS 4.8%
CVE-2026-76455 Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control VulnerabilitiesCisco · Published 7 Oct 2026 · CVSS 9.8 · EPSS 3.6%
CVE-2025-71383 Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi networ…Published 6 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-105778 Tenda AC5 Wifi setWifi stack-based overflowTenda · Published 6 Oct 2026 · CVSS 9.4 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`Microsoft · Published 6 Oct 2026 · CVSS 9.1 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-106037 Mooncake through 0.3.13.post1 Missing Authentication in Store REST Servicekvcache-ai · Published 6 Oct 2026 · CVSS 9.3 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypasshandlebars-lang · Published 6 Oct 2026 · CVSS 9.2 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)handlebars-lang · Published 6 Oct 2026 · CVSS 9.8 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-106511 CVE-2026-106511MultiversX Labs S.R.L. · Published 6 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cachesmarty-php · Published 6 Oct 2026 · CVSS 9.2 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-105284 Totolink A3002MU Authentication Check boa sub_40FCFC improper authorizationtotolink · Published 5 Oct 2026 · CVSS 10.0 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-105285 Totolink A3002MU QoS Rule formIpQoS stack-based overflowtotolink · Published 5 Oct 2026 · CVSS 10.0 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-105636 Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)makeplane · Published 5 Oct 2026 · CVSS 9.9 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-105637 Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)makeplane · Published 5 Oct 2026 · CVSS 9.6 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-105638 Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forcemakeplane · Published 5 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-105640 Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)makeplane · Published 5 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypassmakeplane · Published 5 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-105691 Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-colorpenpot · Published 5 Oct 2026 · CVSS 9.9 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverLangflow · Published 5 Oct 2026 · CVSS 9.9 · EPSS 1% · Public PoC (CISA)
CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource EndpointCamunda · Published 5 Oct 2026 · CVSS 9.2 · EPSS 0.7% · Public PoC (CISA)
CVE-2026-88391 Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor…Published 5 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-88393 WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.Published 5 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-88395 GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.Published 5 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-88424 FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService…Published 5 Oct 2026 · CVSS 9.8 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-105086 WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video TitleWWBN · Published 4 Oct 2026 · CVSS 9.3 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-105089 WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 TemplatesWWBN · Published 4 Oct 2026 · CVSS 9.3 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-105135 InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injectionInternLM · Published 4 Oct 2026 · CVSS 10.0 · EPSS 0.8% · Public PoC (CISA)
CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload TokenH3C · Published 2 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API ModeYesWiki · Published 2 Oct 2026 · CVSS 9.2 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-104610 Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflowTenda · Published 2 Oct 2026 · CVSS 10.0 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Executiontinylibs · Published 2 Oct 2026 · CVSS 9.5 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-104849 Tinypool: Prototype Pollution Gadget to RCE in run() optionstinylibs · Published 2 Oct 2026 · CVSS 9.5 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-51904 SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.Published 2 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-51906 In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability all…Published 2 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51911 vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).Published 2 Oct 2026 · CVSS 9.8 · EPSS 1.1% · Public PoC (CISA)
CVE-2026-51918 FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().Published 2 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51922 agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py).Published 2 Oct 2026 · CVSS 9.8 · EPSS 1.1% · Public PoC (CISA)
CVE-2026-103244 ground-station before 0.8.0 Authentication Bypass via setup.restoresgoudelis · Published 1 Oct 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transportkvcache-ai · Published 1 Oct 2026 · CVSS 9.3 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-104056 CVE-2026-104056authlib · Published 1 Oct 2026 · CVSS 9.8 · EPSS 0.2% · Public PoC (CISA)
CVE-2026-51875 In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows a…Published 1 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51876 DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow.Published 1 Oct 2026 · CVSS 9.1 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-51879 deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write…Published 1 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51880 deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute.Published 1 Oct 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-51881 deeptutor 1.4.0 contains code injection in ExecTool.execute.Published 1 Oct 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51882 The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal.Published 1 Oct 2026 · CVSS 9.1 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-51883 The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path tr…Published 1 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51884 The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to…Published 1 Oct 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-51886 langflow-ai langflow v1.9.3 is affected by: Code Injection.Published 1 Oct 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-51893 infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap.Published 1 Oct 2026 · CVSS 9.8 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-51897 RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).Published 1 Oct 2026 · CVSS 9.8 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-53953 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account TakeoverGetSimpleCMS-CE · Published 1 Oct 2026 · CVSS 9.1 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-56660 GetSimple CMS: CSRF, SSRF, and Unrestricted Zip ExtractionGetSimpleCMS-CE · Published 1 Oct 2026 · CVSS 9.1 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-56662 GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update requestGetSimpleCMS-CE · Published 1 Oct 2026 · CVSS 9.6 · EPSS 0.2% · Public PoC (CISA)
CVE-2026-102911 zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injectionzosmaai · Published 30 Sep 2026 · CVSS 9.4 · EPSS 1.8% · Public PoC (CISA)
CVE-2026-102992 piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envpiscinajs · Published 30 Sep 2026 · CVSS 9.2 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-103056 AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTRbeenuar · Published 30 Sep 2026 · CVSS 9.4 · EPSS 1.8% · Public PoC (CISA)
CVE-2026-103395 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC ServiceModelTC · Published 30 Sep 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-51856 In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available t…Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51857 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through…Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-51858 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command ex…Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-51859 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng…Published 30 Sep 2026 · CVSS 9.1 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-51861 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51862 DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_da…Published 30 Sep 2026 · CVSS 9.1 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-51864 DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi…Published 30 Sep 2026 · CVSS 9.1 · EPSS 0.9% · Public PoC (CISA)
CVE-2026-51866 In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed throug…Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51867 agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-51869 DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-51870 DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.Published 30 Sep 2026 · CVSS 9.8 · EPSS 1.1% · Public PoC (CISA)
CVE-2026-51871 Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allow…Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.5% · Public PoC (CISA)
CVE-2026-51872 Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-55107 Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)elct9620 · Published 30 Sep 2026 · CVSS 10.0 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-55176 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer tokenSoft-Machine-io · Published 30 Sep 2026 · CVSS 9.0 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-55181 Tugtainer: OIDC login remains accessible when OIDC_ENABLED is falseQuenary · Published 30 Sep 2026 · CVSS 9.4 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unsetQuenary · Published 30 Sep 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpointQuenary · Published 30 Sep 2026 · CVSS 9.1 · EPSS 0.3% · Public PoC (CISA)
CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpBynameFumasoft · Published 29 Sep 2026 · CVSS 9.3 · EPSS 0.6% · Public PoC (CISA)
CVE-2024-31026 An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitr…Published 29 Sep 2026 · CVSS 9.8 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-101354 FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflowFAST · Published 29 Sep 2026 · CVSS 9.4 · EPSS 0.4% · Public PoC (CISA)
CVE-2026-102240 Netcore NAP930 Network Tools CGI network_tools eval os command injectionNetcore · Published 29 Sep 2026 · CVSS 10.0 · EPSS 2% · Public PoC (CISA)
CVE-2026-102792 Ziroom ZHOME A0101 set_syslog command injectionZiroom · Published 29 Sep 2026 · CVSS 9.4 · EPSS 3%
CVE-2026-102793 Ziroom ZHOME A0101 set_time_zone command injectionZiroom · Published 29 Sep 2026 · CVSS 9.4 · EPSS 2.5% · Public PoC (CISA)
CVE-2026-102794 Ziroom ZHOME A0101 ping command injectionZiroom · Published 29 Sep 2026 · CVSS 9.4 · EPSS 2.4% · Public PoC (CISA)
CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionsteveukx · Published 29 Sep 2026 · CVSS 9.2 · EPSS 0.3% · Public PoC (CISA)
CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC ServiceModelTC · Published 29 Sep 2026 · CVSS 9.3 · EPSS 1% · Public PoC (CISA)
CVE-2026-103041 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC ServiceModelTC · Published 29 Sep 2026 · CVSS 9.3 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-39117 An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attack…Published 29 Sep 2026 · CVSS 9.8 · EPSS 0.8% · Public PoC (CISA)
CVE-2026-77177 Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code…Published 29 Sep 2026 · CVSS 9.8 · EPSS 0.6% · Public PoC (CISA)
CVE-2026-94952 A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmwa…Published 29 Sep 2026 · CVSS 9.8 · EPSS 0.4% · Public PoC (CISA)

Source: CVE List, as of 29 Oct 2026; FIRST EPSS, as of 29 Oct 2026. About the data.

Vendors on the watchlist

totolink12 records
Microsoft10 records
Apache6 records
Edimax6 records
Linksys5 records
makeplane5 records
Adobe4 records
MervinPraison4 records
Tenda4 records
Wavlink4 records

Source: CVE List, as of 29 Oct 2026. About the data.