boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Thursday, October 8, 2026 · all times UTC← 2026-10-07 · archive

Security Box Score — October 8, 2026

CISA adds 5 to KEV; 507 CVEs published, led by IBM (93).

507 CVEs published October 8, 2026: 51 critical, 191 high, 223 medium, 23 low; 0 in the KEV catalog at press time; 1 with a public exploit reference; 19 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 107 on continuation pages.

Standings

League
MTDYTD2025 same span2025 full
CVEs published323953273——
KEV catalog size1739

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

3459 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux2106415532269174911560.17.8.0018+22 ▲
google2913122381120313831378090.37.4.0026+162 ▲
microsoft192921208200269417290311.17.8.0047-956 ▼
red hat899885439648256200.06.5.0033+39 ▲
apple056467166317148991.66.5.00190
suse053827162000.07.5.0035-9 ▼
canonical2521612195000.07.8.0022+2 ▲
freebsd04823673000.07.8.00160
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco36218698563160177.88.4.0044+24 ▲
ubiquiti065362810334.69.1.00500
palo alto networks0461426151324.34.7.00220
fortinet142121017330819.07.2.0040-8 ▼
netgear03400277000.04.3.0027-2 ▼
f502671441527.78.7.0050-7 ▼
ivanti0246162025520.88.8.0152-10 ▼
sonicwall4238105019417.47.8.0049-1 ▼
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache124831169378262213320.27.5.0057+114 ▲
mozilla2381123170870900.08.8.0031-33 ▼
gitlab21068246311532.85.3.0035+2 ▲
drupal094119668411.15.7.0027-26 ▼
github225212110000.07.4.0052-1 ▼
docker6181980000.07.2.0016+6 ▲
wordpress0614103350.08.7.03630
eclipse022000000.09.3.00500
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
oracle0290558116605631012840.17.8.00360
ibm117114021254036721610.17.5.0037+45 ▲
adobe08308236437592150.67.5.0036-170 ▼
progress7731643131611.48.0.0045+5 ▲
zohocorp04262970000.08.3.0117-5 ▼
solarwinds0261853010415.49.1.00670
veeam62571170100.08.5.0036+6 ▲
atlassian11028001300.07.8.0043+1 ▲
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
d-link07422281212300.08.5.0164-8 ▼
siemens052633103000.07.3.0026-14 ▼
synology046510256000.05.6.00320
rockwell automation04353260000.08.6.0029-18 ▼
advantech02021710000.08.6.0071-2 ▼
schneider electric01821150000.08.5.0044-4 ▼
hitachi energy0122460000.07.0.0025-4 ▼
abb0111640000.07.2.00180
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
dell224004118015821210.37.2.0027-33 ▼
nvidia230325207710000.07.8.0019-30 ▼
sourcecodester1725400149105000.05.5.0041-9 ▼
openclaw022851178521000.07.1.00310
hewlett packard enterprise (hpe)382043992649110.57.3.0042-48 ▼
mongodb141836103686100.07.1.0037-20 ▼
spring017013608314000.06.5.00330
itsourcecode141670042125000.02.1.0033-10 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-85706.929699.810.0
CVE-2026-87902.399898.68.1
CVE-2026-76461.282798.19.8
CVE-2026-93616.196597.39.8
CVE-2026-76460.140396.510.0
CVE-2026-85102.075594.49.8
CVE-2026-12269.069994.08.8
CVE-2026-77692.065693.67.5
CVE-2026-17176.049792.07.7
CVE-2026-12268.047391.68.8
Highest CVSS
CVECVSSEPSSNote
CVE-2026-8570610.0.9296KEV
CVE-2026-7646010.0.1403KEV
CVE-2026-10548410.0.0213
CVE-2026-8597810.0.0144
CVE-2026-7336910.0.0125
CVE-2026-7569910.0.0125
CVE-2026-7570310.0.0125
CVE-2026-7572110.0.0125
CVE-2026-8441210.0.0125
CVE-2026-8927510.0.0125
Most disclosures (vendor)
VendorCVEs
linux2137
google824
oracle634
ibm449
apache309
red hat303
apple247
dell174
mozilla158
nvidia137
Most KEV additions (YTD)
VendorKEV
microsoft31
cisco17
apple9
google9
fortinet8
linux6
adobe5
ivanti5
berriai4
checkpoint4
Most-affected ecosystems
EcosystemAdvisories
Maven135
NuGet29
npm27
Packagist23
PyPI17
Go12
crates.io10
RubyGems5
Fastest to KEV
CVEVendorDays
CVE-2026-58704Google0
CVE-2026-86950Apple0
CVE-2026-87491Google0
CVE-2026-88779NetScaler0
CVE-2026-93952Arista Networks0
CVE-2026-102489Zammad GmbH1
CVE-2026-102490Zammad GmbH1
CVE-2026-84869ConnectWise2
CVE-2026-87902WordPress2
CVE-2026-67277Mikrotik4
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104n/a2021-11-171786
CVE-2021-27102n/a2021-11-171786
CVE-2021-27101n/a2021-11-171786
CVE-2021-27103n/a2021-11-171786
CVE-2021-21017Adobe2021-11-171786
CVE-2021-28550Adobe2021-11-171786
CVE-2021-42013Apache Software Foundation2021-11-171786
CVE-2021-41773Apache Software Foundation2021-11-171786
CVE-2021-30858Apple2021-11-171786
CVE-2021-30860Apple2021-11-171786

Transactions

ADDED TO KEV — CVE-2015-3306. Remediation due October 11, 2026.

ADDED TO KEV — CVE-2015-5477. Remediation due October 11, 2026.

ADDED TO KEV — CVE-2016-3081. Remediation due October 11, 2026.

ADDED TO KEV — CVE-2021-3199. Remediation due October 11, 2026.

ADDED TO KEV — CVE-2023-22894. Remediation due October 11, 2026.

EXPLOIT PUBLISHED — vim/vim: 35 CVEs (CVE-2021-3927, CVE-2021-3928, CVE-2021-3968, CVE-2021-3973, CVE-2021-3974, CVE-2021-4136, CVE-2021-4166, CVE-2022-0213, CVE-2022-0351, CVE-2022-1616, CVE-2022-1619, CVE-2022-1620, CVE-2022-1674, CVE-2022-2042, CVE-2022-2124, CVE-2022-2125, CVE-2022-2126, CVE-2022-2129, CVE-2022-2175, CVE-2022-2182, CVE-2022-2183, CVE-2022-2206, CVE-2022-2207, CVE-2022-2208, CVE-2022-2210, CVE-2022-2257, CVE-2022-2284, CVE-2022-2285, CVE-2022-2286, CVE-2022-2287, CVE-2022-2304, CVE-2022-2343, CVE-2022-2344, CVE-2022-2345, CVE-2022-2522). Public exploit references added.

EXPLOIT PUBLISHED — Wireshark Foundation Wireshark: 12 CVEs (CVE-2026-95387, CVE-2026-95388, CVE-2026-95389, CVE-2026-95392, CVE-2026-95393, CVE-2026-95394, CVE-2026-95395, CVE-2026-96415, CVE-2026-96416, CVE-2026-96417, CVE-2026-96418, CVE-2026-96419). Public exploit references added.

EXPLOIT PUBLISHED — rabbitmq-server: 6 CVEs (CVE-2026-66073, CVE-2026-67408, CVE-2026-67409, CVE-2026-67410, CVE-2026-67411, CVE-2026-67412). Public exploit references added.

EXPLOIT PUBLISHED — Videolabs: 6 CVEs (CVE-2020-6071, CVE-2020-6072, CVE-2020-6073, CVE-2020-6077, CVE-2020-6078, CVE-2020-6079). Public exploit references added.

EXPLOIT PUBLISHED — binutils: 5 CVEs (CVE-2020-35493, CVE-2020-35494, CVE-2020-35495, CVE-2020-35496, CVE-2020-35507). Public exploit references added.

EXPLOIT PUBLISHED — traefik: 5 CVEs (CVE-2026-67309, CVE-2026-85594, CVE-2026-85595, CVE-2026-85596, CVE-2026-85597). Public exploit references added.

EXPLOIT PUBLISHED — steipete summarize: 4 CVEs (CVE-2026-45242, CVE-2026-45243, CVE-2026-45244, CVE-2026-45245). Public exploit references added.

EXPLOIT PUBLISHED — Google Chrome: 3 CVEs (CVE-2023-3079, CVE-2026-106201, CVE-2026-106273). Public exploit references added.

EXPLOIT PUBLISHED — gradle: 3 CVEs (CVE-2021-29428, CVE-2021-29429, CVE-2021-32751). Public exploit references added.

EXPLOIT PUBLISHED — https://github.com/curl/curl: 3 CVEs (CVE-2021-22901, CVE-2022-27778, CVE-2022-30115). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2013-7285. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2015-20107. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2016-5018 (Apache Software Foundation Apache Tomcat). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-9233. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2018-1060 ([UNKNOWN] python). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2018-16156. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-12086. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-12972. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-13962. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-14250. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-15217. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-15218. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-15219. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-16869. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-19721. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-19965. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-20383. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-20444. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-20445. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-20794. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-20920. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-5459 (VLC). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-5460 (VLC Media Player). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-8906. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-0570 (QT Library). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-1054 (Microsoft Windows 10 Version 1507). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-12769. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-19188. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-1967 (OpenSSL). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-25639 (kernel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-26116. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-26664. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-28097. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-28500 (Lodash). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-29374. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-35490. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-35491. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36183. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36185. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36186. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36187. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36188. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36189. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36327. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-36558. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-5258 (dojo). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-7598 (minimist). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-7639 (@eivifj/dot). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-7712 (json). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-7788 (ini). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-8022 (SUSE Enterprise Storage 5). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-21290 (netty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-23337 (Lodash). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-23369 (handlebars). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-23383 (handlebars). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-23450 (dojo). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-27568. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-29921. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-32537 (Realtek HDA driver). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-33624. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-34141. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-34693. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-3733 (python). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-3807 (chalk/ansi-regex). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-38198. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-39537. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-43975. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-44533 (NodeJS Node). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-44906. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-45402. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-45949. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-46195. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-0144 (shelljs/shelljs). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-0529 (unzip). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-0530 (unzip). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-27943. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-32189 (Go standard library math/big). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-33070. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-26119 (net.sourceforge.htmlunit:htmlunit). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-30589 (NodeJS Node). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-42366. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-48161. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-51764. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-11371 (Gladinet CentreStack and TrioFox). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-34267 (FlowiseAI Flowise). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-34469 (Cowrie). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-71177 (LavaLite CMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-0621 (Anthropic MCP TypeScript SDK). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-100846 (Project-MONAI MONAI). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102826 (steveukx git-js). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102827 (steveukx git-js). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-103001 (jpadilla pyjwt). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-105749 (docling-project docling). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-105775 (vllm-project vLLM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-105808 (SourceCodester Simple Student Information System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-105920 (Kusalkasilva Learning-Management-System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-105957 (SourceCodester Performance Indicator System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-22680 (Volcengine OpenViking). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-32846 (OpenClaw). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-39904 (gophish). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-40035 (obsidianforensics unfurl). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-40036 (obsidianforensics unfurl). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-40525 (volcengine OpenViking). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-47117 (maziyarpanahi openmed). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-57516 (Anyscale, Inc Ray). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-58372 (seaweedfs). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-58473 (topoteretes cognee). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-58660 (kanboard). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-59804 (web-infra-dev midscene). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-59806 (gradio-app gradio). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-59807 (ComposioHQ composio). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-61461 (langgenius dify). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-62238 (openremote). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-65899 (cure53 DOMPurify). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-78682 (nltk). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-79657 (nltk). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86431 (thephpleague commonmark). Public exploit reference added.

DUE DATE PASSED — CVE-2026-88779 (NetScaler ADC). CISA remediation deadline was October 7, 2026; still in catalog.

REJECTED — CVE-2026-39725 (Jonathan Horowitz Content Visibility for Divi Builder). Record withdrawn by the CNA.

RESCORED — vim/vim: 14 CVEs (CVE-2021-3927, CVE-2021-3928, CVE-2021-3973, CVE-2021-3974, CVE-2021-4136, CVE-2022-0213, CVE-2022-0351, CVE-2022-1616, CVE-2022-1619, CVE-2022-1620, CVE-2022-1674, CVE-2022-2042, CVE-2022-2208, CVE-2022-2287). CVSS rescored — before/after on each CVE page.

RESCORED — IBM Langflow OSS: 7 CVEs (CVE-2026-93443, CVE-2026-93445, CVE-2026-93449, CVE-2026-93675, CVE-2026-93677, CVE-2026-101331, CVE-2026-103360). CVSS rescored — before/after on each CVE page.

RESCORED — Foxit Software Inc. Foxit PDF Editor: 5 CVEs (CVE-2026-91802, CVE-2026-91803, CVE-2026-91812, CVE-2026-91813, CVE-2026-91818). CVSS rescored — before/after on each CVE page.

RESCORED — gradle: 4 CVEs (CVE-2021-29428, CVE-2021-29429, CVE-2023-35946, CVE-2023-44387). CVSS rescored — before/after on each CVE page.

RESCORED — Dell CPG BIOS: 3 CVEs (CVE-2021-36323, CVE-2021-36324, CVE-2021-36325). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2015-20107. CVSS 7.8 → 7.6 (NVD).

RESCORED — CVE-2018-1060 ([UNKNOWN] python). CVSS 4.3 → 7.5 (NVD).

RESCORED — CVE-2018-1115 (unspecified postgresql). CVSS 4.2 → 9.1 (NVD).

RESCORED — CVE-2019-10219 (hibernate-validator). CVSS 6.5 → 6.1 (NVD).

RESCORED — CVE-2019-14892 (Red Hat jackson-databind). CVSS 7.5 → 9.8 (NVD).

RESCORED — CVE-2019-14893 (Red Hat jackson-databind). CVSS 7.5 → 9.8 (NVD).

RESCORED — CVE-2020-5398 (Spring Framework). CVSS 8 → 7.5 (NVD).

RESCORED — CVE-2020-5421 (Spring by VMware Spring Framework). CVSS 8.7 → 6.5 (NVD).

RESCORED — CVE-2020-7788 (ini). CVSS 7.3 → 9.8 (NVD).

RESCORED — CVE-2020-8022 (SUSE Enterprise Storage 5). CVSS 7.7 → 7.8 (NVD).

RESCORED — CVE-2021-21290 (netty). CVSS 6.2 → 5.5 (NVD).

RESCORED — CVE-2021-23369 (handlebars). CVSS 5.6 → 9.8 (NVD).

RESCORED — CVE-2021-23383 (handlebars). CVSS 5.6 → 9.8 (NVD).

RESCORED — CVE-2021-23450 (dojo). CVSS 7.5 → 9.8 (NVD).

RESCORED — CVE-2021-34866 (Linux Kernel). CVSS 8.8 → 7.8 (NVD).

RESCORED — CVE-2021-41277 (metabase). CVSS 10 → 7.5 (NVD).

RESCORED — CVE-2021-45949. CVSS 3.9 → 5.5 (NVD).

RESCORED — CVE-2022-27544 (HCL Software HCL BigFix). CVSS 5 → 6.5 (NVD).

RESCORED — CVE-2022-27545 (HCL Software HCL BigFix). CVSS 4.6 → 5.4 (NVD).

RESCORED — CVE-2023-20900 (VMware Tools). CVSS 7.1 → 7.5 (NVD).

RESCORED — CVE-2023-23946 (git). CVSS 6.2 → 7.5 (NVD).

RESCORED — CVE-2025-22037 (Linux). CVSS 5.5 → 7.5 (NVD).

RESCORED — CVE-2025-58903 (Fortinet FortiOS). CVSS 2.5 → 4.9 (NVD).

RESCORED — CVE-2026-102677 (electron). CVSS 7.8 → 8.8 (NVD).

RESCORED — CVE-2026-102827 (steveukx git-js). CVSS 8.1 → 9.8 (NVD).

RESCORED — CVE-2026-105743 (docling-project docling). CVSS 4 → 5.8 (NVD).

RESCORED — CVE-2026-106188 (Google Chrome). CVSS 6.1 → 7.1 (NVD).

RESCORED — CVE-2026-106218 (JetBrains TeamCity). CVSS 8.8 → 10 (NVD).

RESCORED — CVE-2026-106219 (JetBrains TeamCity). CVSS 6.5 → 7.5 (NVD).

RESCORED — CVE-2026-17643 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 8.8 → 7.1 (NVD).

RESCORED — CVE-2026-17644 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 8.8 → 7.1 (NVD).

RESCORED — CVE-2026-17645 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 9.1 → 8.8 (NVD).

RESCORED — CVE-2026-17646 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 8.5 → 6.5 (NVD).

RESCORED — CVE-2026-18066 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 7.9 → 7.1 (NVD).

RESCORED — CVE-2026-18152 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 7.4 → 7.5 (NVD).

RESCORED — CVE-2026-18153 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 5.4 → 7.1 (NVD).

RESCORED — CVE-2026-18154 (IBM Financial Transaction Manager (FTM) for RedHat OpenShift). CVSS 8 → 7.5 (NVD).

RESCORED — CVE-2026-26950 (Dell SmartFabric Manager). CVSS 8.1 → 8.8 (NVD).

RESCORED — CVE-2026-54471 (Dell SmartFabric Manager). CVSS 3.5 → 6.5 (NVD).

RESCORED — CVE-2026-54472 (Dell Container Storage Modules). CVSS 9.8 → 7.5 (NVD).

RESCORED — CVE-2026-67101 (HCL Software HCL BigFix Service Management). CVSS 9.3 → 5.8 (NVD).

RESCORED — CVE-2026-67103 (HCL Software HCL BigFix Service Management). CVSS 7.6 → 6.1 (NVD).

RESCORED — CVE-2026-70600 (electron). CVSS 3.1 → 4.3 (NVD).

RESCORED — CVE-2026-95387 (Wireshark Foundation Wireshark). CVSS 8.1 → 8.8 (NVD).

RESCORED — CVE-2026-96419 (Wireshark Foundation Wireshark). CVSS 5.5 → 7.8 (NVD).

PATCH SHIPPED — CVE-2026-102490 (Zammad GmbH Zammad). Fixed in Zammad 7.2.2.

PATCH SHIPPED — CVE-2026-11837 (Red Hat Enterprise Linux 10.0 Extended Update Support). Fixed in Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.2.3-6.el10_0.2.

PATCH SHIPPED — CVE-2026-18839 (rpm-software-management popt). Fixed in Red Hat Hardened Images 1.19-11.2.hum1.

PATCH SHIPPED — CVE-2026-32582 (iatoai IATO MCP). Fixed in IATO MCP 1.12.1.

PATCH SHIPPED — CVE-2026-39723 (Green Invoice Morning for WooCommerce). Fixed in Morning for WooCommerce 2.4.2.

PATCH SHIPPED — CVE-2026-87853 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:2.12.0-3.el10_2.2.

ENRICHED — Apache Software Foundation Apache Tomcat: 17 CVEs (CVE-2016-0762, CVE-2016-5018, CVE-2016-6796, CVE-2016-6797, CVE-2019-12418, CVE-2019-17563, CVE-2020-17527, CVE-2021-24122, CVE-2021-25122, CVE-2021-25329, CVE-2021-30640, CVE-2021-33037, CVE-2021-41079, CVE-2022-25762, CVE-2022-29885, CVE-2022-34305, CVE-2023-42794). Received CVSS/CPE analysis.

ENRICHED — Linux: 13 CVEs (CVE-2026-63988, CVE-2026-63989, CVE-2026-63999, CVE-2026-98078, CVE-2026-98131, CVE-2026-98132, CVE-2026-98133, CVE-2026-98134, CVE-2026-98135, CVE-2026-98136, CVE-2026-98137, CVE-2026-98138, CVE-2026-98139). Received CVSS/CPE analysis.

ENRICHED — The Node.js Project Node.js: 13 CVEs (CVE-2018-7158, CVE-2018-7159, CVE-2018-7160, CVE-2018-7161, CVE-2018-7162, CVE-2018-7164, CVE-2018-7166, CVE-2018-7167, CVE-2018-12116, CVE-2018-12120, CVE-2018-12121, CVE-2018-12122, CVE-2018-12123). Received CVSS/CPE analysis.

ENRICHED — HP PC BIOS: 11 CVEs (CVE-2022-23924, CVE-2022-23925, CVE-2022-23926, CVE-2022-23927, CVE-2022-23928, CVE-2022-23929, CVE-2022-23930, CVE-2022-23931, CVE-2022-23932, CVE-2022-23933, CVE-2022-23934). Received CVSS/CPE analysis.

ENRICHED — kernel: 10 CVEs (CVE-2020-14390, CVE-2020-25639, CVE-2021-3655, CVE-2021-4001, CVE-2021-4135, CVE-2021-20320, CVE-2022-0264, CVE-2022-0500, CVE-2023-1838, CVE-2023-2269). Received CVSS/CPE analysis.

ENRICHED — OpenSSL: 9 CVEs (CVE-2018-0732, CVE-2018-0734, CVE-2018-0735, CVE-2019-1551, CVE-2019-1563, CVE-2020-1967, CVE-2021-3449, CVE-2021-3450, CVE-2021-3711). Received CVSS/CPE analysis.

ENRICHED — Apache Tomcat: 6 CVEs (CVE-2020-1935, CVE-2020-9484, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943). Received CVSS/CPE analysis.

ENRICHED — HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC: 6 CVEs (CVE-2022-23953, CVE-2022-23954, CVE-2022-23955, CVE-2022-23956, CVE-2022-23957, CVE-2022-23958). Received CVSS/CPE analysis.

ENRICHED — HP Support Assistant: 6 CVEs (CVE-2020-6917, CVE-2020-6918, CVE-2020-6919, CVE-2020-6920, CVE-2020-6921, CVE-2020-6922). Received CVSS/CPE analysis.

ENRICHED — binutils: 5 CVEs (CVE-2020-35493, CVE-2020-35494, CVE-2020-35495, CVE-2020-35496, CVE-2020-35507). Received CVSS/CPE analysis.

ENRICHED — NodeJS Node: 4 CVEs (CVE-2021-44533, CVE-2023-30585, CVE-2023-30589, CVE-2023-30590). Received CVSS/CPE analysis.

ENRICHED — Spring Framework: 4 CVEs (CVE-2022-22950, CVE-2022-22968, CVE-2022-22970, CVE-2022-22971). Received CVSS/CPE analysis.

ENRICHED — https://github.com/curl/curl: 3 CVEs (CVE-2021-22901, CVE-2022-27778, CVE-2022-30115). Received CVSS/CPE analysis.

ENRICHED — Pivotal Spring Framework: 3 CVEs (CVE-2018-1257, CVE-2018-11039, CVE-2018-11040). Received CVSS/CPE analysis.

ENRICHED — CVE-2013-7285. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2015-6748. Received CVSS 6.1 and CPE data from NVD.

ENRICHED — CVE-2015-8859. Received CVSS 5.3 and CPE data from NVD.

ENRICHED — CVE-2016-0718. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2016-2568. Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2016-3674. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2016-4472. Received CVSS 8.1 and CPE data from NVD.

ENRICHED — CVE-2016-9063 (Mozilla Firefox). Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2016-9840. Received CVSS 8.8 and CPE data from NVD.

ENRICHED — CVE-2016-9841. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2017-1000158. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2017-15095 (FasterXML jackson-databind). Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2017-5645 (Apache Software Foundation Apache Log4j). Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2017-7525 (FasterXML jackson-databind). Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2017-7957. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2017-8529 (Microsoft Corporation Internet Explorer). Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2017-9233. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2018-1000802. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-1000879. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2018-1000880. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2018-11307. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-12022. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2018-1270 (Spring by Pivotal Spring Framework). Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-14718. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-14719. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-16156. Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2018-16301 (The Tcpdump Group tcpdump). Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2018-5407 (Processors supporting Simultaneous Multi-Threading). Received CVSS 4.7 and CPE data from NVD.

ENRICHED — CVE-2018-5968. Received CVSS 8.1 and CPE data from NVD.

ENRICHED — CVE-2019-0123 (2019.2 IPU – Intel(R) SGX and TXT). Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2019-0124 (2019.2 IPU – Intel(R) SGX and TXT). Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2019-10086 (Apache Commons Beanutils). Received CVSS 7.3 and CPE data from NVD.

ENRICHED — CVE-2019-11136 (2019.2 IPU – UEFI). Received CVSS 6.7 and CPE data from NVD.

ENRICHED — CVE-2019-11137 (2019.2 IPU – UEFI). Received CVSS 8.2 and CPE data from NVD.

ENRICHED — CVE-2019-12086. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2019-12384. Received CVSS 5.9 and CPE data from NVD.

+ 164 more transaction lines — continued on page 2. Every change is listed; nothing truncated.

Yesterday's Results

How to read these box scores · glossary

507 CVEs published. 25 box scores and 375 table rows below; the remaining 107 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-105110CRITICAL
Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0279   86.0     —
AFFECTED
  Product  Versions     Fixed
  Innbox   unspecified  —
TIMELINE
  Oct 3   Reserved by CNA
  Oct 8   Published (CNA: TuranSec)
CWE-78, CWE-306 · CNA: TuranSec · CVSS v4.0 · 1 reference · NVD status: Deferred
CVE-2026-94579MEDIUM
Brocade Fabric OS — An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup r…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   P   L   P   H   H   H    5.4   .0265   85.2     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 21  Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87666HIGH
Brocade Fabric OS — An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   L   N   H   H   H    8.6   .0185   78.4     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-107459CRITICAL
Openfind｜SecuShare Pro - OS Command Injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0147   72.9     —
AFFECTED
  Product        Versions  Fixed
  SecuShare Pro  4 –       —
TIMELINE
  Oct 8   Reserved by CNA
  Oct 8   Published (CNA: twcert)
CWE-78 · CNA: twcert · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-94581HIGH
Brocade Fabric OS — An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS vers…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   H   N   H   H   H    8.5   .0130   69.5     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 21  Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-94586HIGH
Brocade Fabric OS — A command injection vulnerability exists in the WebTools administrative interface handling configuration do…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   H   N   H   H   H    8.5   .0125   68.4     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 21  Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2017-20283MEDIUM
NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() impleme…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  L    6.5   .0119   67.0     —
AFFECTED
  Product  Versions     Fixed
  MQX      unspecified  —
TIMELINE
  Sep 9   Reserved by CNA
  Oct 8   Published (CNA: mitre)
CWE-787 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87680HIGH
Brocade Fabric OS — A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   L   N   H   H   N    8.5   .0102   62.3     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87673HIGH
Brocade Fabric OS — An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fa…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   H   P   H   H   H    7.0   .0090   58.4     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87682HIGH
Brocade Fabric OS — Multiple OS Command Injection vulnerabilities exist in the management interface and session processing rout…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   L   N   H   H   H    8.6   .0086   57.4     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87665MEDIUM
Brocade Fabric OS — A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   P   N   N   N   L   H    6.0   .0085   56.8     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-121 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87663HIGH
Brocade Fabric OS — An authentication bypass and command injection vulnerability exists in the inter-switch remote execution se…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   P   H   N   H   H   H    7.1   .0073   53.0     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-290 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87675HIGH
Brocade Fabric OS — An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   H   P   H   H   H    7.3   .0073   52.9     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-87677MEDIUM
Brocade Fabric OS — An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versi…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   P   H   P   H   H   H    5.4   .0062   48.0     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-17196HIGH
WebRehab Super Forms – Drag & Drop Form Builder — Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0053   43.3     —
AFFECTED
  Product                                 Versions     Fixed
  Super Forms – Drag & Drop Form Builder  unspecified  —
TIMELINE
  Jul 24  Reserved by CNA
  Oct 8   Published (CNA: Wordfence)
CWE-434 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred
CVE-2026-107446MEDIUM
containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultan…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  C  N  N  H    6.8   .0041   32.9     —
AFFECTED
  Product    Versions     Fixed
  overlaybd  unspecified  —
TIMELINE
  Oct 8   Reserved by CNA
  Oct 8   Published (CNA: mitre)
CWE-190 · CNA: mitre · CVSS v3.1 · 5 references · NVD status: Awaiting Analysis
CVE-2026-4894MEDIUM
Frappe Technologies Frappe Technologies — Authentication bypass in multiple products from Frappe Technologies
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   N    6.9   .0038   29.8     —
AFFECTED
  Product              Versions                     Fixed
  Frappe Technologies  Version before 23/03/2026 –  —
TIMELINE
  Mar 26  Reserved by CNA
  Oct 8   Published (CNA: INCIBE)
CWE-290 · CNA: INCIBE · CVSS v4.0 · 1 reference · NVD status: Deferred
CVE-2026-94576MEDIUM
Brocade Fabric OS — An authentication logic and privilege escalation vulnerability exists in the account management interface o…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   H   N   L   N   N   H   H    5.9   .0036   27.6     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 21  Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-187 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-85097CRITICAL
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0031   22.1     —
AFFECTED
  Product      Versions     Fixed
  Bricksforge  unspecified  —
TIMELINE
  Sep 3   Reserved by CNA
  Oct 8   Published (CNA: Wordfence)
CWE-434 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred
CVE-2026-17609CRITICAL
WebRehab Super Forms – Drag & Drop Form Builder — Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  H    9.1   .0031   21.7     —
AFFECTED
  Product                                 Versions     Fixed
  Super Forms – Drag & Drop Form Builder  unspecified  —
TIMELINE
  Jul 27  Reserved by CNA
  Oct 8   Published (CNA: Wordfence)
CWE-434 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred
CVE-2023-5648MEDIUM
Brocade Active Support Connectivity Gateway — In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Bro…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   L    6.5   .0029   20.1     —
AFFECTED
  Product                              Versions     Fixed
  Active Support Connectivity Gateway  unspecified  —
TIMELINE
  Oct 19  Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-79 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-85490HIGH
Brocade Brocade Active Support Connectivity Gateway — When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   P   N   N   H   H   H    7.7   .0027   18.0     —
AFFECTED
  Product                                      Versions     Fixed
  Brocade Active Support Connectivity Gateway  unspecified  —
TIMELINE
  Sep 3   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-22 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
CVE-2026-82627HIGH
uncannyowl Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included — Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  U  H  H  H    7.5   .0027   16.9     —
AFFECTED
  Product                                                                                                Versions     Fixed
  Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included  unspecified  —
TIMELINE
  Aug 30  Reserved by CNA
  Oct 8   Published (CNA: Wordfence)
CWE-502 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred
CVE-2024-8122MEDIUM
WSO2 WSO2 Identity Server — Potential brute force vulnerability due to non-expiring SMS OTPs
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  N  N    5.9   .0025   15.5     —
AFFECTED
  Product               Versions  Fixed
  WSO2 Identity Server  5.11.0 –  —
TIMELINE
  Aug 23  Reserved by CNA
  Oct 8   Published (CNA: WSO2)
CWE-613 · CNA: WSO2 · CVSS v3.1 · 1 reference · NVD status: Deferred
CVE-2026-87662HIGH
Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols u…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   H   P   H   H   H    7.0   .0024   13.6     —
AFFECTED
  Product    Versions     Fixed
  Fabric OS  unspecified  —
TIMELINE
  Sep 8   Reserved by CNA
  Oct 8   Published (CNA: brocade)
CWE-78 · CNA: brocade · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-945787.513.4BrocadeFabric OSCWE-269Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulne…
CVE-2026-876848.712.6BrocadeFabric OSCWE-121A stack-based buffer overflow vulnerability exists in the SNMP daemon request…
CVE-2026-1226010.012.4NetBoard CRMNetBoard CRM Demo PlatformCWE-89SQL injection in the NetBoard CRM demo platform
CVE-2026-854868.612.4BrocadeBrocade Active Support Connectivity GatewayCWE-95Brocade ASCG before 3.5.0 improperly processes user input by evaluating form …
CVE-2026-876717.112.2BrocadeFabric OSCWE-125An out-of-bounds memory read vulnerability exists in the web management daemo…
CVE-2026-891916.811.9SQLViewSQLView KRISCWE-79Stored Cross-Site Scripting in SQLView KRIS
CVE-2026-868286.611.4UnknownBackWPupCWE-22BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
CVE-2026-1074505.410.5stumpappStumpCWE-863In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL muta…
CVE-2026-1024888.79.9Octopus DeployOctopus ServerCWE-863In affected versions, Octopus Server incorrectly evaluates multiple scoped pe…
CVE-2026-854238.69.9BrocadeBrocade Active Support Connectivity GatewayCWE-306A vulnerability has been identified in the data collection service of Brocade…
CVE-2026-854878.69.6BrocadeBrocade Active Support Connectivity GatewayCWE-22A path traversal vulnerability exists in the HTTP service component of Brocad…
CVE-2026-1074444.39.6Red HatRed Hat Hardened ImagesCWE-639Rubygem-katello: katello: katello: katello docker tags repositories api cross…
CVE-2026-876786.99.2BrocadeFabric OSCWE-93An input validation and output encoding vulnerability exists in the web manag…
CVE-2026-876865.39.1BrocadeFabric OSCWE-290An authentication and access control bypass vulnerability exists in the web s…
CVE-2026-1036469.88.8UnknownUltimate MultisiteCWE-287Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'emai…
CVE-2026-854218.78.3BrocadeBrocade Active Support Connectivity GatewayCWE-306A critical security vulnerability has been identified in Brocade ASCG version…
CVE-2026-1074666.18.0Red HatRed Hat Enterprise Linux 10CWE-22Flatpak-builder: local file exfiltration via `file
CVE-2026-876878.57.9BrocadeFabric OSCWE-88An authorization and input validation vulnerability exists in Brocade Fabric …
CVE-2026-876678.47.8BrocadeFabric OSCWE-88An argument injection vulnerability exists in the configuration management co…
CVE-2026-854898.77.7BrocadeBrocade Active Support Connectivity GatewayCWE-306An authentication flaw exists in the Brocade ASCG administrative management s…
CVE-2026-660826.57.8Apache Software FoundationApache DolphinSchedulerCWE-863Apache DolphinScheduler: Cross-project authorization bypasses in DolphinSched…
CVE-2026-50478.27.5BrocadeBrocade SANnavCWE-922A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded pass…
CVE-2026-50486.17.5BrocadeBrocade SANnavCWE-89In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various ex…
CVE-2026-1033097.57.4UnknownGPTranslateCWE-79GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation S…
CVE-2026-945756.97.4BrocadeFabric OSCWE-483A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web managem…
CVE-2026-945805.77.4BrocadeFabric OSCWE-22An arbitrary file and directory deletion vulnerability exists in the REST API…
CVE-2026-50496.96.7BrocadeBrocade SANnavCWE-22A path traversal vulnerability affects the The Zone Alias Import flow feature…
CVE-2026-660848.16.6Apache Software FoundationApache DolphinSchedulerCWE-863Apache DolphinScheduler: Project Authorization Bypass in the Task Definition …
CVE-2026-876838.66.4BrocadeFabric OSCWE-121Multiple stack-based buffer overflow vulnerabilities exist in the REST API ma…
CVE-2026-1074455.46.3Red HatRed Hat Hardened ImagesCWE-639Rubygem-katello: katello: katello: katello flatpak remote repositories api cr…
CVE-2026-718957.16.1Apache Software FoundationApache DolphinSchedulerCWE-862Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users t…
CVE-2026-874248.66.1BrocadeBrocade Active Support Connectivity GatewayCWE-321A vulnerability in the SupportLink API authentication component of Brocade AS…
CVE-2026-876817.16.1BrocadeFabric OSCWE-269An Access Control Bypass vulnerability exists in the Role-Based Access Contro…
CVE-2026-945857.75.4BrocadeFabric OSCWE-288An authentication bypass vulnerability exists in the web management interface…
CVE-2026-660878.15.1Apache Software FoundationApache DolphinSchedulerCWE-863Apache DolphinScheduler: Project Authorization Bypass in the Task instance st…
CVE-2026-876686.95.1BrocadeFabric OSCWE-121A stack-based buffer overflow vulnerability exists in the diagnostic executio…
CVE-2026-718966.55.1Apache Software FoundationApache DolphinSchedulerCWE-863Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disc…
CVE-2026-876616.85.1BrocadeFabric OSCWE-93Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly…
CVE-2026-1046466.85.0UnknownImage Photo Gallery Final Tiles GridCWE-79Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via G…
CVE-2026-1074493.44.9linuxserverHeimdallCWE-918linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection…
CVE-2026-876798.54.7BrocadeFabric OSCWE-122When Brocade Fabric OS versions before 10.0.1 processes trunk configuration o…
CVE-2026-874265.33.9BrocadeBrocade Active Support Connectivity GatewayCWE-200An unauthenticated network-based attacker can query specific internal managem…
CVE-2026-868275.33.8UnknownBackWPupCWE-862BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
CVE-2026-711837.13.6Apache Software FoundationApache DolphinSchedulerCWE-863Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Dat…
CVE-2026-945876.93.5BrocadeFabric OSCWE-120A buffer overflow vulnerability exists in the WebTools administrative interfa…
CVE-2026-1051944.33.6UnknownEasy Digital DownloadsCWE-200Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure…
CVE-2026-1051952.73.6UnknownBooking CalendarCWE-200Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
CVE-2026-1036929.83.4UnknownFrontend DashboardCWE-269Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via A…
CVE-2026-876858.43.4BrocadeFabric OSCWE-73An arbitrary file manipulation vulnerability exists in the WebTools managemen…
CVE-2026-945842.13.3BrocadeFabric OSCWE-362A race condition and thread-safety vulnerability exists in the web management…
CVE-2026-868265.93.3UnknownBackWPupCWE-200BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Work…
CVE-2026-942755.33.3UnknownTrack Orders for WooCommerceCWE-200Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'em…
CVE-2026-876597.13.2BrocadeFabric OSCWE-306A critical authorization bypass vulnerability exists in the Management Server…
CVE-2026-1074483.43.2Wizards of the CoastMagic: The Gathering ArenaCWE-99Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 a…
CVE-2026-1046452.73.0UnknownImage Photo Gallery Final Tiles GridCWE-639Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Galler…
CVE-2026-876695.12.8BrocadeFabric OSCWE-862A missing authorization check in Brocade Fabric OS versions before 10.0.1 RES…
CVE-2026-876705.12.8BrocadeFabric OSCWE-290An authorization logic vulnerability exists in the Brocade Fabric OS versions…
CVE-2026-942444.32.8UnknownWallet System for WooCommerceCWE-200Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transac…
CVE-2026-942582.72.8UnknownSMS AlertCWE-200SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bu…
CVE-2026-936998.52.5WebProsWP ToolkitCWE-88Argument injection in WP Toolkit for cPanel allows local users to execute arb…
CVE-2026-942456.52.4UnknownWallet System for WooCommerceCWE-639Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet B…
CVE-2026-942466.32.4UnknownWallet System for WooCommerceCWE-639Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet With…
CVE-2026-1051985.32.4UnknownAppointment Booking PluginCWE-639LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
CVE-2026-1051963.32.4UnknownAppointment Booking PluginCWE-639LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via A…
CVE-2026-1051972.72.4UnknownAppointment Booking PluginCWE-639LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion…
CVE-2026-876607.02.1BrocadeFabric OSCWE-732An improper file permission and missing authorization vulnerability exists in…
CVE-2026-945826.82.0BrocadeFabric OSCWE-120A memory buffer overflow vulnerability exists in the internal diagnostic and …
CVE-2026-876648.51.8BrocadeFabric OSCWE-306A session context forgery vulnerability exists in the web management daemon o…
CVE-2026-876726.81.4BrocadeFabric OSCWE-532An information disclosure vulnerability exists in the SupportLink diagnostic …
CVE-2026-928615.11.2Wavedash Co., Ltd.Ticket Ryutsu CenterCWE-798The Android application "Ticket Ryutsu Center" contains hard-coded credential…
CVE-2026-928624.61.2Wavedash Co., Ltd.Ticket Ryutsu CenterCWE-939The Android application "Ticket Ryutsu Center" improperly handles custom URL …
CVE-2026-945832.11.1BrocadeFabric OSCWE-362A race condition vulnerability exists in the request processing logic of the …
CVE-2026-876748.51.1BrocadeFabric OSCWE-78A local privilege escalation vulnerability exists in the system logging daemo…
CVE-2026-876888.51.0BrocadeFabric OSCWE-77An input validation vulnerability exists in the security certificate manageme…
CVE-2026-854228.41.0BrocadeBrocade Active Support Connectivity GatewayCWE-798A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker …
CVE-2026-874257.61.0BrocadeBrocade Active Support Connectivity GatewayCWE-295An unauthenticated remote attacker can modify the TLS client trust store in B…
CVE-2026-1051934.80.9UnknownBooking CalendarCWE-326Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and …
CVE-2026-945777.30.9BrocadeFabric OSCWE-15A privilege escalation vulnerability exists in the internal Command-Line Inte…
CVE-2023-56496.80.8BrocadeBrocade Active Support Connectivity GatewayCWE-20An Improper Input Validation vulnerability for the registered case credential…
CVE-2026-877263.90.7NXPNxpNfcRdLibCWE-787Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 throu…
CVE-2026-1052604.30.7UnknownDatabase Addon For WPForms ( wpforms entries )CWE-352Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF
CVE-2026-874288.40.6BrocadeBrocade Active Support Connectivity GatewayCWE-522In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who ca…
CVE-2026-876766.90.6BrocadeFabric OSCWE-121A stack-based buffer overflow vulnerability exists in the security library co…
CVE-2026-854887.00.5BrocadeBrocade Active Support Connectivity GatewayCWE-798Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded …
CVE-2026-57695.60.0BrocadeBrocade SANnavCWE-313A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS…
CVE-2026-9620710.0—MicrosoftMicrosoft Partner CenterCWE-295Microsoft Partner Center Elevation of Privilege Vulnerability
CVE-2026-945109.9—MicrosoftMicrosoft BookingsCWE-639Microsoft Bookings Elevation of Privilege Vulnerability
CVE-2026-142699.8—IBMDataPower Gateway 10.6CDCWE-122IBM DataPower Gateway Buffer Overflow
CVE-2026-145029.8—IBMDataPower Gateway 10.6CDCWE-287IBM DataPower Gateway Improper Authentication
CVE-2026-149919.8—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-149929.8—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-157629.8—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-163409.8—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-758759.8—IBMGuardium Data ProtectionCWE-22Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-779009.8—MicrosoftAzure App Service for LinuxCWE-306Azure App Service Remote Code Execution Vulnerability
CVE-2026-784019.8—IBMSecurity Verify AccessCWE-502Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-784069.8—IBMSecurity Verify AccessCWE-502Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-803819.8—IBMGuardium Data ProtectionCWE-89Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-842499.8—IBMGuardium Data ProtectionCWE-306IBM Guardium Data Protection is affected by vulnerability
CVE-2026-842729.8—IBMGuardium Data ProtectionCWE-306IBM Guardium Data Protection Missing Authentication
CVE-2026-881319.8—MicrosoftMicrosoft DataverseCWE-502Microsoft Dataverse Remote Code Execution Vulnerability
CVE-2026-925559.8—AKIN Software Computer Import-Export Industry and Trade Co. Ltd.AKINSOFT WOLVOX Control PanelCWE-201Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel
CVE-2026-930349.8—SGLangSGLangCWE-502CVE-2026-93034
CVE-2026-1077229.8—nearformfast-jwtCWE-347fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-en…
CVE-2026-694359.6—MicrosoftAzure SRE AgentCWE-918Azure SRE Agent Elevation of Privilege Vulnerability
CVE-2026-1074069.5—NetScalerADC—Memory overflow vulnerability leading to Remote Code Execution or Denial of S…
CVE-2026-1036639.4—OllamaOllamaCWE-23Path Traversal leading to Remote Code Execution in Ollama
CVE-2026-1061269.4—Tenable, Inc.Tenable Identity Exposure (SaaS)CWE-78Command Injection
CVE-2026-92099.3—mJobmJobTimeCWE-250mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
CVE-2026-149909.3—IBMDataPower Gateway 10.6.0CWE-79IBM DataPower Gateway affected by cross-site scripting
CVE-2026-842449.3—IBMGuardium Data ProtectionCWE-79IBM Guardium Data Protection Cross-Site Scripting
CVE-2026-1040759.3—TVU NetworksTVU Receiver / TransceiverCWE-288TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login
CVE-2026-1040769.3—TVU NetworksTVU Receiver / TransceiverCWE-306TVU Networks Receiver/Transceiver Missing Authentication via REST API
CVE-2026-1076409.3—IntegricsEnswitchCWE-640Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
CVE-2026-1076999.3—tzwmppt2pngCWE-78ppt2png through 0.0.6 OS Command Injection via input and output paths
CVE-2026-1077009.3—ntharimdot-accessCWE-94dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
CVE-2026-1077039.3—enmaso@enmaso/node-convertCWE-78@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and conv…
CVE-2026-1077049.3—jtescherimage_optimizerCWE-78image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
CVE-2026-1077269.3—hazelcasthazelcastCWE-20Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-1077799.3—dromaraskyeyeCWE-306Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
CVE-2026-1077809.3—dromaraskyeyeCWE-78Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format P…
CVE-2026-168239.1—IBMSecurity Verify AccessCWE-287Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-169169.1—IBMSecurity Verify AccessCWE-693Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-192189.1—AKIN Software Computer Import-Export Industry and Trade Co. Ltd.MyRezztaCWE-640Password Reset Code Brute Force Leading to Account Takeover in AKIN Software'…
CVE-2026-194919.1—IBMSecurity Verify AccessCWE-287Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-798429.1—Hewlett Packard EnterpriseHPE Intelligent Management Center (iMC)—An authentication bypass vulnerability exists in HPE Intelligent Management C…
CVE-2026-952109.1—n/an/aCWE-295Improper certificate validation in gnutls v3.8.13 causes the application to a…
CVE-2026-1075109.1—InfobloxNIOSCWE-88Authenticated argument injection in NIOS command line leading to privilege es…
CVE-2026-1077819.1—dromaraskyeyeCWE-918Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFi…
CVE-2026-187408.8—IBMSecurity Verify AccessCWE-88Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-190838.8—AKIN Software Computer Import-Export Industry and Trade Co. Ltd.OctoCloudCWE-639IDOR in AKIN Software's OctoCloud
CVE-2026-194828.8—IBMSecurity Verify AccessCWE-88Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-621428.8—MelapressWP 2FACWE-352WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerab…
CVE-2026-890918.8—Red HatMigration Toolkit for Applications 8CWE-59Ansible-core: ansible-core: ansible-galaxy collection install symlink path es…
CVE-2026-1054368.8—MainWPMainWP ChildCWE-502WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vu…
CVE-2026-1073758.8—jhipstergenerator-jhipsterCWE-89JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebF…
CVE-2026-1077018.8—ntharimdot-accessCWE-1321dot-access through 1.0.0 Prototype Pollution via set() path argument
CVE-2026-440318.7—OFFISDCMTKCWE-674Uncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticat…
CVE-2026-839438.7—MicrosoftAzure API Center—Azure API Center Information Disclosure Vulnerability
CVE-2026-938588.7—OpenStackMistralCWE-78In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a call…
CVE-2026-1010248.7—SatelSatel Netco DesignCWE-23Satel Netco Design Relative path traversal
CVE-2026-1027848.7—balbooa.comGridbox extension for JoomlaCWE-352Joomla Extension - balbooa.com - CSRF in language installation feature Gridbo…
CVE-2026-1056728.7—TP-Link Systems Inc.Tapo C325WB v2CWE-287Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C…
CVE-2026-1056748.7—TP-Link Systems Inc.Tapo C325WB v2CWE-330Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB
CVE-2026-1058308.7—thephpleaguecommonmarkCWE-400league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
CVE-2026-1064338.7—MongoDBlibmongocryptCWE-843Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
CVE-2026-1073788.7—KozeaCairoSVGCWE-407CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CVE-2026-1076398.7—ILIAS-eLearning e.V.ILIASCWE-88ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question …
CVE-2026-1077258.7—hazelcasthazelcastCWE-862Hazelcast: Authorization bypass in IMap Predicates API
CVE-2026-161598.6—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-161638.6—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-819328.6—IBMGuardium Data ProtectionCWE-89Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-113188.5—Zuler TechnologyDeskInCWE-306Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer
CVE-2026-1040778.5—ObsidianObsidian DesktopCWE-79Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
CVE-2026-1052698.5—SatelSatel Netco DesignCWE-79Satel Netco Design Cross-site Scripting
CVE-2026-1073228.5—awsdatabases-on-awsCWE-184OS command injection in Amazon Agent Plugins for AWS databases-on-aws
CVE-2026-1077078.5—IntegoIntego AntivirusCWE-59Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization …
CVE-2026-1077828.5—winsiderssSystem InformerCWE-863System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
CVE-2026-842508.4—IBMGuardium Data ProtectionCWE-798IBM Guardium Data Protection Hard-coded Credentials
CVE-2026-1040788.4—ObsidianObsidian DesktopCWE-79Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
CVE-2026-1077328.4—sumatrapdfreadersumatrapdfCWE-94SumatraPDF: Markup/command-link injection into UI notification text
CVE-2026-1058338.3—espocrmespocrmCWE-522EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
CVE-2026-1077058.3—freedesktoppopplerCWE-121Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Ha…
CVE-2026-144968.2—IBMDataPower Gateway 10.6CDCWE-125IBM DataPower Gateway Out-of-bounds Read
CVE-2026-149058.2—IBMDataPower Gateway 10.6CDCWE-611IBM DataPower Gateway XXE
CVE-2026-158248.2—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Denial of Service
CVE-2026-171898.2—IBMSecurity Verify AccessCWE-79Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-1054058.2—ImageMagickImageMagickCWE-763ImageMagick before 7.1.2-31 Invalid Memory Free in MVG Decoder
CVE-2026-1058248.2—ImageMagickImageMagickCWE-416ImageMagick before 7.1.2-30 Use-After-Free in RSVG Decoder Without Cairo
CVE-2026-1073248.2—MongoDBGo DriverCWE-190Application denial of service via integer overflow in BSON value-length valid…
CVE-2026-1073258.2—MongoDBGo DriverCWE-129Application denial of service via missing BSON array length validation in Mon…
CVE-2026-1073768.2—webonyxgraphql-phpCWE-674webonyx graphql-php: Unbounded recursion in parser causes stack overflow on c…
CVE-2026-1078298.2—banqjivejdonCWE-916Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
CVE-2026-144978.1—IBMDataPower Gateway 10.6CDCWE-347IBM DataPower Gateway Improper Verification of Cryptographic Signature
CVE-2026-148888.1—IBMDataPower Gateway 10.6CDCWE-122IBM DataPower Gateway Buffer Overflow
CVE-2026-157848.1—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-194948.1—IBMSecurity Verify AccessCWE-287Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-823348.1—IBMGuardium Data ProtectionCWE-125IBM Guardium Data Protection Out-of-bounds Read
CVE-2026-823358.1—IBMGuardium Data ProtectionCWE-119IBM Guardium Data Protection Buffer Overflow
CVE-2026-823448.1—IBMGuardium Data ProtectionCWE-119IBM Guardium Data Protection Buffer Overflow
CVE-2026-828958.1—IBMGuardium Data ProtectionCWE-120Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-829008.1—IBMGuardium Data ProtectionCWE-22IBM Guardium Data Protection is affected by multiple vulnerabilities.
CVE-2026-840358.1—IBMGuardium Data ProtectionCWE-121Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-840578.1—IBMGuardium Data ProtectionCWE-78IBM Guardium Data Protection is affected by multiple vulnerabilities.
CVE-2026-840588.1—IBMGuardium Data ProtectionCWE-119Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-841988.1—IBMGuardium Data ProtectionCWE-120Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-842098.1—IBMGuardium Data ProtectionCWE-89IBM Guardium Data Protection is affected by multiple vulnerabilities.
CVE-2026-842468.1—IBMGuardium Data ProtectionCWE-120Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-842478.1—IBMGuardium Data ProtectionCWE-22IBM Guardium Data Protection is affected by multiple vulnerabilities.
CVE-2026-1073338.1—CISAMalcolmCWE-863Incorrect Authorization in Malcolm
CVE-2026-1073848.1—mariadb-corporationmariadb-connector-nodejsCWE-89MariaDB Connector/Node.js: SQL injection through object keys in SET expansion…
CVE-2026-1077238.1—nearformfast-jwtCWE-1287fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
CVE-2026-157818.0—IBMDataPower Gateway 10.6CDCWE-121IBM DataPower Gateway Buffer Overflow
CVE-2026-1036478.0—Progressive Robot LtdhMailServerCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scri…
CVE-2026-842457.8—IBMGuardium Data ProtectionCWE-269IBM Guardium Data Protection Privilege Escalation
CVE-2026-842717.8—IBMGuardium Data ProtectionCWE-362IBM Guardium Data Protection Signature Verification Bypass
CVE-2026-1030107.8—Progressive Robot LtdhMailServerCWE-122Heap-based Buffer Overflow in hMailServer
CVE-2026-1046587.8—Progressive Robot LtdhMailServerCWE-807Reliance on Untrusted Inputs in a Security Decision in hMailServer
CVE-2026-1046607.8—Progressive Robot LtdhMailServerCWE-862Missing Authorization in hMailServer
CVE-2026-1075737.8—Progressive Robot LtdhMailServerCWE-276Incorrect Default Permissions in hMailServer
CVE-2026-1076127.8—GlavSoftTightVNCCWE-338World-accessible IPC shared memory with predictable name in TightVNC Server
CVE-2026-1076157.8—GlavSoftTightVNCCWE-427DLL search order hijacking via screenhooks libraries in TightVNC Server
CVE-2026-1077097.8—Bower Decompress-Zipdecompress-zipCWE-22Bower decompress-zip has a path traversal vulnerability
CVE-2026-145077.7—IBMDataPower Gateway 11.0.0CWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-839477.7—MicrosoftAzure Event Grid SystemCWE-862Azure Event Grid Spoofing Vulnerability
CVE-2026-930177.7—Red HatRed Hat OpenShift Container Platform 4CWE-269Insights-operator: gather serviceaccount has cluster-wide secret read plus no…
CVE-2026-1050767.6—AppsbdViteposCWE-89WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
CVE-2026-1072957.6—pydanticpydantic-aiCWE-352`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin req…
CVE-2026-1073037.6—jhipstergenerator-jhipsterCWE-79JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob Conte…
CVE-2026-1076387.6—ph7softwareph7builderCWE-307pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php
CVE-2026-158197.5—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-158227.5—IBMDataPower Gateway 10.6CDCWE-405IBM DataPower Gateway Denial of Service
CVE-2026-161117.5—IBMDataPower Gateway 10.6CDCWE-843IBM DataPower Gateway Type Confusion
CVE-2026-161617.5—IBMDataPower Gateway 10.6CDCWE-125IBM DataPower Gateway Out-of-bounds Read
CVE-2026-161647.5—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-161657.5—IBMDataPower Gateway 10.6CDCWE-476IBM DataPower Gateway NULL Pointer Dereference
CVE-2026-161677.5—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-161697.5—IBMDataPower Gateway 11.0.0CWE-400IBM DataPower Gateway Denial of Service
CVE-2026-161707.5—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-161767.5—IBMDataPower Gateway 10.6CDCWE-770IBM DataPower Gateway Denial of Service
CVE-2026-161787.5—IBMDataPower Gateway 10.6CDCWE-787IBM DataPower Gateway Out-of-bounds Write
CVE-2026-161797.5—IBMDataPower Gateway 10.6CDCWE-124IBM DataPower Gateway Buffer Underwrite
CVE-2026-194937.5—IBMSecurity Verify AccessCWE-22Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-676937.5—n/an/aCWE-367An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive informatio…
CVE-2026-842307.5—IBMGuardium Data ProtectionCWE-362IBM Guardium Data Protection is affected by multiple vulnerabilities
CVE-2026-842757.5—IBMGuardium Data ProtectionCWE-22IBM Guardium Data Protection Path Traversal
CVE-2026-842767.5—IBMGuardium Data ProtectionCWE-400IBM Guardium Data Protection Denial of Service
CVE-2026-848757.5—IBMGuardium Data ProtectionCWE-119Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium…
CVE-2026-951847.5—n/an/aCWE-400Improper certificate validation in gnutls v3.8.13 causes the application to r…
CVE-2026-952087.5—n/an/aCWE-295An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wo…
CVE-2026-952097.5—n/an/aCWE-400An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, …
CVE-2026-1036497.5—Progressive Robot LtdhMailServerCWE-1088Synchronous Access of Remote Resource without Timeout in hMailServer
CVE-2026-1046597.5—Progressive Robot LtdhMailServerCWE-346Origin Validation Error in hMailServer
CVE-2026-1072867.5—pydanticpydantic-aiCWE-772Pydantic AI: Concurrency-limited models can keep their slot when a streamed r…
CVE-2026-1073007.5—mcollinamsgpack5CWE-674msgpack5: Many buffered values can exhaust the streaming decoder stack
CVE-2026-1073027.5—mcollinamsgpack5CWE-125msgpack5: Truncated map32 headers throw an unexpected error
CVE-2026-1073777.5—datamodel-code-generatordatamodel-code-generatorCWE-22datamodel-code-generator: Protobuf weak-import path traversal allows files to…
CVE-2026-1073837.5—mariadb-corporationmariadb-connector-nodejsCWE-200MariaDB Connector/Node.js exposes uninitialized process memory through malfor…
CVE-2026-1075747.5—Progressive Robot LtdhMailServerCWE-407Inefficient Algorithmic Complexity in hMailServer
CVE-2026-1075767.5—Progressive Robot LtdhMailServerCWE-407Inefficient Algorithmic Complexity in hMailServer
CVE-2026-1075777.5—Progressive Robot LtdhMailServerCWE-835Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer
CVE-2026-1075797.5—Progressive Robot LtdhMailServerCWE-407Inefficient Algorithmic Complexity in hMailServer
CVE-2026-1075897.5—Jacamar CIJacamar CICWE-290Authentication Bypass by Spoofing in Jacamar CI
CVE-2026-1077287.5—strawberry-graphqlstrawberryCWE-863Strawberry GraphQL: Synchronous permission checks can treat an awaitable auth…
CVE-2026-149997.4—IBMDataPower Gateway 10.6CDCWE-347IBM DataPower Gateway Improper Verification of Cryptographic Signature
CVE-2026-161817.4—IBMDataPower Gateway 10.6CDCWE-285IBM DataPower Gateway Improper Authorization
CVE-2026-1047047.4—Progressive Robot LtdhMailServerCWE-319Cleartext Transmission of Sensitive Information in hMailServer
CVE-2026-1073187.4—@fastify/reply-from@fastify/reply-fromCWE-295@fastify/reply-from vulnerable to improper certificate validation in built-in…
CVE-2026-1073857.4—mariadb-corporationmariadb-connector-nodejsCWE-89MariaDB Connector/Node.js: SQL injection in the text protocol when the sessio…
CVE-2026-1075847.4—Progressive Robot LtdhMailServerCWE-636Not Failing Securely ('Failing Open') in hMailServer
CVE-2026-1077207.4—nearformfast-jwtCWE-20fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and alg…
CVE-2026-1077247.4—nearformfast-jwtCWE-347fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token f…
CVE-2026-918447.3—İzometri IT Services Domestic and Foreign Trade Co. Ltd.eimzamipCWE-434Remote Code Execution via Unrestricted File Upload in İzometri Informatics' e…
CVE-2026-1077167.3—mascibanksCWE-22Banks: Symlink traversal and arbitrary file disclosure/overwrite in Directory…
CVE-2026-842787.2—IBMGuardium Data ProtectionCWE-78IBM Guardium Data Protection Command Injection
CVE-2026-971477.2—OpenStackMistralCWE-863In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolv…
CVE-2026-408047.1—Kodezen LLCaBlocksCWE-79WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-500547.1—ZimbraZimbra Collaboration SuiteCWE-269Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granti…
CVE-2026-664797.1—Liquid Web / StellarWPWPCompleteCWE-352WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
CVE-2026-938607.1—OpenStackMistralCWE-862In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clear…
CVE-2026-1046287.1—SatelSatel Netco DesignCWE-1333Satel Netco Design Inefficient Regular Expression Complexity
CVE-2026-1056737.1—TP-Link Systems Inc.Tapo C325WB v2CWE-121Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C…
CVE-2026-1064297.1—MongoDBlibmongocryptCWE-191Application denial of service via malformed KMS endpoint in MongoDB libmongoc…
CVE-2026-1066117.1—WPMU DEVForminatorCWE-352WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vul…
CVE-2026-1073377.1—CISAMalcolmCWE-352Cross-Site Request Forgery in Malcolm
CVE-2026-1073627.1—CISAMalcolmCWE-918Server-Side Request Forgery in Malcolm
CVE-2026-1075037.1—Eclipse DittoDitto Explorer UICWE-15Unvalidated environments URL allows OAuth authorization code + PKCE verifier …
CVE-2026-1076117.1—GlavSoftTightVNCCWE-125Out-of-bounds read in TightVNC Viewer ZRLE palette decoding
CVE-2026-1076367.1—ph7softwareph7builderCWE-472pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController
CVE-2026-1076957.1—FFmpegFFmpegCWE-835FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
CVE-2026-1076967.1—FFmpegFFmpegCWE-835FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
CVE-2026-1077347.1—sumatrapdfreadersumatrapdfCWE-20SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Co…
CVE-2026-1077787.1—MITkrb5CWE-476MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
CVE-2026-1078027.1—sumatrapdfreadersumatrapdfCWE-88SumatraPDF — Windows command-line argument injection in AI selection-translate
CVE-2025-714286.9—banqjivejdonCWE-89Jivejdon through 5.0 SQL Injection via username in userListAction
CVE-2026-1053996.9—ImageMagickImageMagickCWE-400ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder
CVE-2026-1054006.9—ImageMagickImageMagickCWE-775ImageMagick before 7.1.2-31 Unclosed File Pointer via Magick Script
CVE-2026-1054026.9—ImageMagickImageMagickCWE-400ImageMagick before 7.1.2-31 Denial of Service via XMP Profile Parsing
CVE-2026-1054036.9—ImageMagickImageMagickCWE-863ImageMagick before 7.1.2-31 Security Policy Bypass via Coder Domain
CVE-2026-1058256.9—ImageMagickImageMagickCWE-400ImageMagick before 7.1.2-30 Denial of Service via Crafted XMP Profile
CVE-2026-1058266.9—ImageMagickImageMagickCWE-409ImageMagick before 7.1.2-30 Security Policy Bypass via MAT Decoder
CVE-2026-1058276.9—ImageMagickImageMagickCWE-674ImageMagick before 7.1.2-30 Stack Overflow in CALS Decoder
CVE-2026-1076346.9—AorimndislockerCWE-125Dislocker through 0.7.3 Heap Out-of-Bounds Read via BitLocker Metadata Datase…
CVE-2026-1077086.9—MITkrb5CWE-476MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
CVE-2026-1078286.9—banqjivejdonCWE-1391Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
CVE-2026-1078306.9—banqjivejdonCWE-799Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRActi…
CVE-2026-440336.8—OFFISDCMTKCWE-674Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service
CVE-2026-440356.8—OFFISDCMTKCWE-674Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service
CVE-2026-440366.8—OFFISDCMTKCWE-674Uncontrolled recursion in DCMTK xml2dcm allows denial of service
CVE-2026-440376.8—OFFISDCMTKCWE-674Uncontrolled recursion in DCMTK JSON reader allows denial of service
CVE-2026-1072756.8—@fastify/jwt@fastify/jwtCWE-390@fastify/jwt vulnerable to missing token expiration when temporal options can…
CVE-2026-1072896.8—pydanticpydantic-aiCWE-918Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (i…
CVE-2026-1073326.8—awsaws-toolkit-vscodeCWE-276Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Vi…
CVE-2026-1073946.8—indicoindicoCWE-918Indico: Incomplete Server-Side Request Forgery (SSRF) check
CVE-2026-1073996.8—sparklemotionmechanizeCWE-200Mechanize sends credential headers to another origin after a meta refresh
CVE-2026-1076086.8—AWSaws-cdk-libCWE-59Improper link resolution in asset bundling output handling in aws-cdk-lib
CVE-2026-1076356.8—AorimndislockerCWE-191Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Under…
CVE-2026-1077156.8—sparklemotionmechanizeCWE-200Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-1077336.8—sumatrapdfreadersumatrapdfCWE-476SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
CVE-2026-1077366.8—sumatrapdfreadersumatrapdfCWE-121SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata
CVE-2026-1077386.8—sumatrapdfreadersumatrapdfCWE-125SumatraPDF: Untrusted binary record offset used without lower-bound validation
CVE-2026-1055706.7—DockerDocker SandboxesCWE-178Docker Sandboxes OAuth response masking could be bypassed with a case-variant…
CVE-2026-1075786.7—Progressive Robot LtdhMailServerCWE-59Improper Link Resolution Before File Access ('Link Following') in hMailServer
CVE-2026-106316.5—ZimbraZimbra Collaboration SuiteCWE-639Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Com…
CVE-2026-128596.5—Caz Informatics Services Trade Inc.Advancity ALMS CloudCWE-862IDOR in Caz Informatics' Advancity ALMS Cloud
CVE-2026-132576.5—IBMDataPower Gateway 10.6CDCWE-345IBM DataPower Gateway Insufficient Verification of Data Authenticity
CVE-2026-142736.5—IBMDataPower Gateway 10.6CDCWE-863IBM DataPower Gateway Incorrect Authorization
CVE-2026-145086.5—IBMDataPower Gateway 10.6CDCWE-416IBM DataPower Gateway Use After Free
CVE-2026-149886.5—IBMDataPower Gateway 10.6CDCWE-125IBM DataPower Gateway Out-of-bounds Read
CVE-2026-198786.5—IBMSecurity Verify AccessCWE-841Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-274206.5—Katie SeabornZotpressCWE-79WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability
CVE-2026-500556.5—ZimbraZimbra Collaboration SuiteCWE-863Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwardin…
CVE-2026-621276.5—MediaRon LLCWP Plugin Info CardCWE-79WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vu…
CVE-2026-783996.5—IBMSecurity Verify AccessCWE-770Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-842746.5—IBMGuardium Data ProtectionCWE-200IBM Guardium Data Protection Information Disclosure
CVE-2026-935096.5—UnknownWallet System for WooCommerceCWE-20Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Man…
CVE-2026-1030116.5—Progressive Robot LtdhMailServerCWE-122Heap-based Buffer Overflow in hMailServer
CVE-2026-1030706.5—ShortPixelShortPixel Image OptimizerCWE-79WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (…
CVE-2026-1050786.5—WP Store LocatorWP Store LocatorCWE-79WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulne…
CVE-2026-1050796.5—StylemixThemesMasterStudy LMSCWE-79WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulne…
CVE-2026-1058866.5—BdThemesUltimate Post KitCWE-862WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerabi…
CVE-2026-1058876.5—RobosoftRobo GalleryCWE-79WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-1058906.5—Liquid Web / StellarWPGutenberg Blocks by Kadence BlocksCWE-79WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Sc…
CVE-2026-1066036.5—GroundhoggHollerBoxCWE-639WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDO…
CVE-2026-1072876.5—pydanticpydantic-aiCWE-400Pydantic AI: Excessive resource use when local web fetching converts nested HTML
CVE-2026-1072906.5—pydanticpydantic-aiCWE-1333Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
CVE-2026-1072946.5—pydanticpydantic-aiCWE-400Pydantic AI: Unbounded memory use when downloading remote content via web_fet…
CVE-2026-1073016.5—mcollinamsgpack5CWE-1321msgpack5: Partial options disable prototype protection
CVE-2026-1073356.5—CISAMalcolmCWE-409Improper Handling of Highly Compressed Data in Malcolm
CVE-2026-1073366.5—CISAMalcolmCWE-290Authentication Bypass by Spoofing in Malcolm
CVE-2026-1073796.5—darylldoylesvg-sanitizerCWE-770enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
CVE-2026-1075726.5—Progressive Robot LtdhMailServerCWE-1333Inefficient Regular Expression Complexity in hMailServer
CVE-2026-1075806.5—Progressive Robot LtdhMailServerCWE-407Inefficient Algorithmic Complexity in hMailServer
CVE-2026-1075816.5—Progressive Robot LtdhMailServerCWE-407Inefficient Algorithmic Complexity in hMailServer
CVE-2026-1075826.5—Progressive Robot LtdhMailServerCWE-407Inefficient Algorithmic Complexity in hMailServer
CVE-2026-1075836.5—Progressive Robot LtdhMailServerCWE-407Inefficient Algorithmic Complexity in hMailServer
CVE-2026-1077176.5—mascibanksCWE-20Banks: User-controlled prompt input can be parsed as privileged chat messages
CVE-2026-118886.4—IBMSecurity Verify AccessCWE-94Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-1061776.4—HP IncHP Sure Click EnterpriseCWE-122HP Sure Click Kernel Buffer Overflow
CVE-2026-1072926.4—pydanticpydantic-aiCWE-346Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoi…
CVE-2026-1027836.3—balbooa.comGridbox extension for JoomlaCWE-22Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.…
CVE-2026-1058286.3—parse-communityparse-serverCWE-209Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL E…
CVE-2026-1064286.3—MongoDBC DriverCWE-125Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
CVE-2026-1064366.3—MongoDBPHP DriverCWE-252Application denial of service and data truncation via unchecked BSON append f…
CVE-2026-1073866.3—rabbitmqamqp091-goCWE-770amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
CVE-2026-1076606.3—FFmpegFFmpegCWE-297FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass…
CVE-2026-1073876.2—Borewitmusic-metadataCWE-789music-metadata: Uncontrolled memory allocation in APEv2 parser
CVE-2026-1073886.2—Borewitmusic-metadataCWE-789music-metadata: ID3v2 tag size not validated before allocation, causing memor…
CVE-2026-1073896.2—Borewitmusic-metadataCWE-789music-metadata: EBML parser trusts element lengths, allowing memory exhaustio…
CVE-2026-1073906.2—Borewitmusic-metadataCWE-789music-metadata: MP4 parser allows memory exhaustion via oversized extended at…
CVE-2026-1073916.2—Borewitmusic-metadataCWE-400music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite l…
CVE-2026-1073926.2—Borewitmusic-metadataCWE-248music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual …
CVE-2026-1073936.1—freescout-help-deskfreescoutCWE-79FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF…
CVE-2026-1076146.1—GlavSoftTightVNCCWE-125Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bo…
CVE-2026-1077186.1—adonisjshttp-serverCWE-601AdonisJS: Unencoded route parameters can produce open redirects
CVE-2026-938616.0—OpenStackMistralCWE-863In OpenStack Mistral through 23.0.0, the workflow membership API lets a proje…
CVE-2026-1054016.0—ImageMagickImageMagickCWE-122ImageMagick before 7.1.2-31 Heap Buffer Overflow in Distributed Pixel Cache S…
CVE-2026-1054046.0—ImageMagickImageMagickCWE-94ImageMagick before 7.1.2-31 Code Injection via PostScript Coders
CVE-2026-1064306.0—MongoDBC++ DriverCWE-436Query and rename target confusion via embedded NUL truncation in MongoDB C++ …
CVE-2026-1076756.0—FFmpegFFmpegCWE-322FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol
CVE-2026-119305.9—IBMSecurity Verify AccessCWE-285Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-145095.9—IBMDataPower Gateway 10.6CDCWE-400IBM DataPower Gateway Denial of Service
CVE-2026-161825.9—IBMDataPower Gateway 10.6CDCWE-476IBM DataPower Gateway NULL Pointer Dereference
CVE-2026-194985.9—IBMSecurity Verify AccessCWE-674Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-848915.9—IBMGuardium Data ProtectionCWE-798Security vulnerability affects the Windows GIM component as part of IBM Guard…
CVE-2026-1019985.9—DockerDocker SandboxesCWE-636Fail-open response masking in Docker Sandboxes can expose proxy-managed crede…
CVE-2026-1053985.9—ImageMagickImageMagickCWE-190ImageMagick before 7.1.2-31 Heap Buffer Overflow via GetVirtualPixels API
CVE-2026-1054525.9—DockerDocker SandboxesCWE-200Docker Sandboxes egress proxy could forward unrecognized client credentials t…
CVE-2026-1064315.9—MongoDBC DriverCWE-787One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
CVE-2026-1064355.9—MongoDBPython DriverCWE-125Application denial of service via out-of-bounds read in BSON Regex decoding i…
CVE-2026-1064375.9—MongoDBC DriverCWE-191Out-of-bounds read and write via undersized BSON buffer reservation in MongoD…
CVE-2026-1072975.9—mcollinamsgpack5CWE-407msgpack5: Quadratic parsing in the streaming decoder
CVE-2026-1072995.9—mcollinamsgpack5CWE-228msgpack5: Reserved byte can cause unbounded stream buffering
CVE-2026-1073825.9—mariadb-corporationmariadb-connector-nodejsCWE-248MariaDB Connector/Node.js: Uncaught exception crashes the client during ed255…
CVE-2026-1075875.9—Progressive Robot LtdhMailServerCWE-295Improper Certificate Validation in hMailServer

Results continue: ranks 401–507.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-10-08 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.